[ 3.8.y.z extended stable ] Patch "rbd: don't destroy ceph_opts in rbd_add()" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    rbd: don't destroy ceph_opts in rbd_add()

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.3.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From cd34f834deff2bb8ca5fc12668120f0699633790 Mon Sep 17 00:00:00 2001
From: Alex Elder <elder at inktank.com>
Date: Thu, 16 May 2013 15:04:20 -0500
Subject: rbd: don't destroy ceph_opts in rbd_add()

commit 7262cfca430a1a0e0707149af29ae86bc0ded230 upstream.

Whether rbd_client_create() successfully creates a new client or
not, it takes responsibility for getting the ceph_opts structure
it's passed destroyed.  If successful, the structure becomes
associated with the created client; if not, rbd_client_create()
will destroy it.

Previously, rbd_get_client() would call ceph_destroy_options()
if rbd_get_client() failed, and that meant it got called twice.
That led freeing various pointers more than once, which is never a
good idea.

This resolves:
    http://tracker.ceph.com/issues/4559

Reported-by: Dan van der Ster <dan at vanderster.com>
Signed-off-by: Alex Elder <elder at inktank.com>
Reviewed-by: Josh Durgin <josh.durgin at inktank.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/block/rbd.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 89576a0..992dd78 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -329,8 +329,8 @@ static const struct block_device_operations rbd_bd_ops = {
 };

 /*
- * Initialize an rbd client instance.
- * We own *ceph_opts.
+ * Initialize an rbd client instance.  Success or not, this function
+ * consumes ceph_opts.
  */
 static struct rbd_client *rbd_client_create(struct ceph_options *ceph_opts)
 {
@@ -469,7 +469,8 @@ static int parse_rbd_opts_token(char *c, void *private)

 /*
  * Get a ceph client with specific addr and configuration, if one does
- * not exist create it.
+ * not exist create it.  Either way, ceph_opts is consumed by this
+ * function.
  */
 static struct rbd_client *rbd_get_client(struct ceph_options *ceph_opts)
 {
@@ -3629,7 +3630,6 @@ static ssize_t rbd_add(struct bus_type *bus,
 		rc = PTR_ERR(rbdc);
 		goto err_out_args;
 	}
-	ceph_opts = NULL;	/* rbd_dev client now owns this */

 	/* pick the pool */
 	osdc = &rbdc->client->osdc;
@@ -3658,8 +3658,6 @@ err_out_rbd_dev:
 err_out_client:
 	rbd_put_client(rbdc);
 err_out_args:
-	if (ceph_opts)
-		ceph_destroy_options(ceph_opts);
 	kfree(rbd_opts);
 	rbd_spec_put(spec);
 err_out_module:
--
1.8.1.2