Pull ceph fixes from Ilya Dryomov: "A fix for a possible use-after-free following "rbd unmap" or "umount" marked for stable and two kernel-doc fixups" * tag 'ceph-for-6.10-rc8' of https://github.com/ceph/ceph-client: libceph: fix crush_choose_firstn() kernel-doc warnings libceph: suppress crush_choose_indep() kernel-doc warnings libceph: fix race between delayed_work() and ceph_monc_stop()
Unified · Split
| @@ -429,7 +429,10 @@ static int is_out(const struct crush_map *map, · 428 unmodified lines | ||
| 429 | 429 | /** |
| 430 | 430 | * crush_choose_firstn - choose numrep distinct items of given type |
| 431 | 431 | * @map: the crush_map |
| 432 | + * @work: working space initialized by crush_init_workspace() | |
| 432 | 433 | * @bucket: the bucket we are choose an item from |
| 434 | + * @weight: weight vector (for map leaves) | |
| 435 | + * @weight_max: size of weight vector | |
| 433 | 436 | * @x: crush input value |
| 434 | 437 | * @numrep: the number of items to choose |
| 435 | 438 | * @type: the type of item to choose |
| @@ -445,6 +448,7 @@ static int is_out(const struct crush_map *map, · 9 unmodified lines | ||
| 445 | 448 | * @vary_r: pass r to recursive calls |
| 446 | 449 | * @out2: second output vector for leaf items (if @recurse_to_leaf) |
| 447 | 450 | * @parent_r: r value passed from the parent |
| 451 | + * @choose_args: weights and ids for each known bucket | |
| 448 | 452 | */ |
| 449 | 453 | static int crush_choose_firstn(const struct crush_map *map, |
| 450 | 454 | struct crush_work *work, |
| @@ -636,9 +640,8 @@ reject: · 185 unmodified lines | ||
| 636 | 640 | } |
| 637 | 641 | |
| 638 | 642 | |
| 639 | −/** | |
| 643 | +/* | |
| 640 | 644 | * crush_choose_indep: alternative breadth-first positionally stable mapping |
| 641 | − * | |
| 642 | 645 | */ |
| 643 | 646 | static void crush_choose_indep(const struct crush_map *map, |
| 644 | 647 | struct crush_work *work, |
| @@ -1085,13 +1085,19 @@ static void delayed_work(struct work_struct *work) · 1084 unmodified lines | ||
| 1085 | 1085 | struct ceph_mon_client *monc = |
| 1086 | 1086 | container_of(work, struct ceph_mon_client, delayed_work.work); |
| 1087 | 1087 | |
| 1088 | − dout("monc delayed_work\n"); | |
| 1089 | 1088 | mutex_lock(&monc->mutex); |
| 1089 | + dout("%s mon%d\n", __func__, monc->cur_mon); | |
| 1090 | + if (monc->cur_mon < 0) { | |
| 1091 | + goto out; | |
| 1092 | + } | |
| 1093 | + | |
| 1090 | 1094 | if (monc->hunting) { |
| 1091 | 1095 | dout("%s continuing hunt\n", __func__); |
| 1092 | 1096 | reopen_session(monc); |
| 1093 | 1097 | } else { |
| 1094 | 1098 | int is_auth = ceph_auth_is_authenticated(monc->auth); |
| 1099 | + | |
| 1100 | + dout("%s is_authed %d\n", __func__, is_auth); | |
| 1095 | 1101 | if (ceph_con_keepalive_expired(&monc->con, |
| 1096 | 1102 | CEPH_MONC_PING_TIMEOUT)) { |
| 1097 | 1103 | dout("monc keepalive timeout\n"); |
| @@ -1116,6 +1122,8 @@ static void delayed_work(struct work_struct *work) · 18 unmodified lines | ||
| 1116 | 1122 | } |
| 1117 | 1123 | } |
| 1118 | 1124 | __schedule_delayed(monc); |
| 1125 | + | |
| 1126 | +out: | |
| 1119 | 1127 | mutex_unlock(&monc->mutex); |
| 1120 | 1128 | } |
| 1121 | 1129 | |
| @@ -1232,13 +1240,15 @@ EXPORT_SYMBOL(ceph_monc_init); · 110 unmodified lines | ||
| 1232 | 1240 | void ceph_monc_stop(struct ceph_mon_client *monc) |
| 1233 | 1241 | { |
| 1234 | 1242 | dout("stop\n"); |
| 1235 | − cancel_delayed_work_sync(&monc->delayed_work); | |
| 1236 | 1243 | |
| 1237 | 1244 | mutex_lock(&monc->mutex); |
| 1238 | 1245 | __close_session(monc); |
| 1246 | + monc->hunting = false; | |
| 1239 | 1247 | monc->cur_mon = -1; |
| 1240 | 1248 | mutex_unlock(&monc->mutex); |
| 1241 | 1249 | |
| 1250 | + cancel_delayed_work_sync(&monc->delayed_work); | |
| 1251 | + | |
| 1242 | 1252 | /* |
| 1243 | 1253 | * flush msgr queue before we destroy ourselves to ensure that: |
| 1244 | 1254 | * - any work that references our embedded con is finished. |