1 files changed, 34 insertions, 0 deletions

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 187bf214444d..603786b564be 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -414,6 +414,9 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
 {
         struct ceph_mds_session *s;
 
+        if (mds >= mdsc->mdsmap->m_max_mds)
+                return ERR_PTR(-EINVAL);
+
         s = kzalloc(sizeof(*s), GFP_NOFS);
         if (!s)
                 return ERR_PTR(-ENOMEM);
@@ -1028,6 +1031,37 @@ static void remove_session_caps(struct ceph_mds_session *session)
 {
         dout("remove_session_caps on %p\n", session);
         iterate_session_caps(session, remove_session_caps_cb, NULL);
+
+        spin_lock(&session->s_cap_lock);
+        if (session->s_nr_caps > 0) {
+                struct super_block *sb = session->s_mdsc->fsc->sb;
+                struct inode *inode;
+                struct ceph_cap *cap, *prev = NULL;
+                struct ceph_vino vino;
+                /*
+                 * iterate_session_caps() skips inodes that are being
+                 * deleted, we need to wait until deletions are complete.
+                 * __wait_on_freeing_inode() is designed for the job,
+                 * but it is not exported, so use lookup inode function
+                 * to access it.
+                 */
+                while (!list_empty(&session->s_caps)) {
+                        cap = list_entry(session->s_caps.next,
+                                         struct ceph_cap, session_caps);
+                        if (cap == prev)
+                                break;
+                        prev = cap;
+                        vino = cap->ci->i_vino;
+                        spin_unlock(&session->s_cap_lock);
+
+                        inode = ceph_lookup_inode(sb, vino);
+                        iput(inode);
+
+                        spin_lock(&session->s_cap_lock);
+                }
+        }
+        spin_unlock(&session->s_cap_lock);
+
         BUG_ON(session->s_nr_caps > 0);
         BUG_ON(!list_empty(&session->s_cap_flushing));
         cleanup_cap_releases(session);