ceph: fix ci->i_head_snapc leak (37659182) · Commits · 戴 / test

We missed two places that i_wrbuffer_ref_head, i_wr_ref, i_dirty_caps and i_flushing_caps may change. When they are all zeros, we should free i_head_snapc. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/38224 Reported-and-tested-by:

Luis Henriques <lhenriques@suse.com> Signed-off-by:

"Yan, Zheng" <zyan@redhat.com> Signed-off-by:

Ilya Dryomov <idryomov@gmail.com>

fs/ceph/mds_client.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -1414,6 +1414,15 @@ static int remove_session_caps_cb(struct inode inode, struct ceph_cap cap,
		list_add(&ci->i_prealloc_cap_flush->i_list, &to_remove);
		ci->i_prealloc_cap_flush = NULL;
		}

		if (drop &&
		ci->i_wrbuffer_ref_head == 0 &&
		ci->i_wr_ref == 0 &&
		ci->i_dirty_caps == 0 &&
		ci->i_flushing_caps == 0) {
		ceph_put_snap_context(ci->i_head_snapc);
		ci->i_head_snapc = NULL;
		}
		}
		spin_unlock(&ci->i_ceph_lock);
		while (!list_empty(&to_remove)) {

fs/ceph/snap.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -572,7 +572,12 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
		old_snapc = NULL;

		update_snapc:
		if (ci->i_head_snapc) {
		if (ci->i_wrbuffer_ref_head == 0 &&
		ci->i_wr_ref == 0 &&
		ci->i_dirty_caps == 0 &&
		ci->i_flushing_caps == 0) {
		ci->i_head_snapc = NULL;
		} else {
		ci->i_head_snapc = ceph_get_snap_context(new_snapc);
		dout(" new snapc is %p\n", new_snapc);
		}

Admin message