Pull ceph fixes from Ilya Dryomov: "A fix for a possible use-after-free following "rbd unmap" or "umount" marked for stable and two kernel-doc fixups" * tag 'ceph-for-6.10-rc8' of https://github.com/ceph/ceph-client: libceph: fix crush_choose_firstn() kernel-doc warnings libceph: suppress crush_choose_indep() kernel-doc warnings libceph: fix race between delayed_work() and ceph_monc_stop()
Unified · Split
| @@ -429,7 +429,10 @@ static int is_out(const struct crush_map *map, · 428 unmodified lines | |||
| 429 | /** | 429 | /** |
| 430 | * crush_choose_firstn - choose numrep distinct items of given type | 430 | * crush_choose_firstn - choose numrep distinct items of given type |
| 431 | * @map: the crush_map | 431 | * @map: the crush_map |
| 432 | * @work: working space initialized by crush_init_workspace() | ||
| 432 | * @bucket: the bucket we are choose an item from | 433 | * @bucket: the bucket we are choose an item from |
| 434 | * @weight: weight vector (for map leaves) | ||
| 435 | * @weight_max: size of weight vector | ||
| 433 | * @x: crush input value | 436 | * @x: crush input value |
| 434 | * @numrep: the number of items to choose | 437 | * @numrep: the number of items to choose |
| 435 | * @type: the type of item to choose | 438 | * @type: the type of item to choose |
| @@ -445,6 +448,7 @@ static int is_out(const struct crush_map *map, · 9 unmodified lines | |||
| 445 | * @vary_r: pass r to recursive calls | 448 | * @vary_r: pass r to recursive calls |
| 446 | * @out2: second output vector for leaf items (if @recurse_to_leaf) | 449 | * @out2: second output vector for leaf items (if @recurse_to_leaf) |
| 447 | * @parent_r: r value passed from the parent | 450 | * @parent_r: r value passed from the parent |
| 451 | * @choose_args: weights and ids for each known bucket | ||
| 448 | */ | 452 | */ |
| 449 | static int crush_choose_firstn(const struct crush_map *map, | 453 | static int crush_choose_firstn(const struct crush_map *map, |
| 450 | struct crush_work *work, | 454 | struct crush_work *work, |
| @@ -636,9 +640,8 @@ reject: · 185 unmodified lines | |||
| 636 | } | 640 | } |
| 637 | 641 | ||
| 638 | 642 | ||
| 639 | /** | 643 | /* |
| 640 | * crush_choose_indep: alternative breadth-first positionally stable mapping | 644 | * crush_choose_indep: alternative breadth-first positionally stable mapping |
| 641 | * | ||
| 642 | */ | 645 | */ |
| 643 | static void crush_choose_indep(const struct crush_map *map, | 646 | static void crush_choose_indep(const struct crush_map *map, |
| 644 | struct crush_work *work, | 647 | struct crush_work *work, |
| @@ -1085,13 +1085,19 @@ static void delayed_work(struct work_struct *work) · 1084 unmodified lines | |||
| 1085 | struct ceph_mon_client *monc = | 1085 | struct ceph_mon_client *monc = |
| 1086 | container_of(work, struct ceph_mon_client, delayed_work.work); | 1086 | container_of(work, struct ceph_mon_client, delayed_work.work); |
| 1087 | 1087 | ||
| 1088 | dout("monc delayed_work\n"); | ||
| 1089 | mutex_lock(&monc->mutex); | 1088 | mutex_lock(&monc->mutex); |
| 1089 | dout("%s mon%d\n", __func__, monc->cur_mon); | ||
| 1090 | if (monc->cur_mon < 0) { | ||
| 1091 | goto out; | ||
| 1092 | } | ||
| 1093 | |||
| 1090 | if (monc->hunting) { | 1094 | if (monc->hunting) { |
| 1091 | dout("%s continuing hunt\n", __func__); | 1095 | dout("%s continuing hunt\n", __func__); |
| 1092 | reopen_session(monc); | 1096 | reopen_session(monc); |
| 1093 | } else { | 1097 | } else { |
| 1094 | int is_auth = ceph_auth_is_authenticated(monc->auth); | 1098 | int is_auth = ceph_auth_is_authenticated(monc->auth); |
| 1099 | |||
| 1100 | dout("%s is_authed %d\n", __func__, is_auth); | ||
| 1095 | if (ceph_con_keepalive_expired(&monc->con, | 1101 | if (ceph_con_keepalive_expired(&monc->con, |
| 1096 | CEPH_MONC_PING_TIMEOUT)) { | 1102 | CEPH_MONC_PING_TIMEOUT)) { |
| 1097 | dout("monc keepalive timeout\n"); | 1103 | dout("monc keepalive timeout\n"); |
| @@ -1116,6 +1122,8 @@ static void delayed_work(struct work_struct *work) · 18 unmodified lines | |||
| 1116 | } | 1122 | } |
| 1117 | } | 1123 | } |
| 1118 | __schedule_delayed(monc); | 1124 | __schedule_delayed(monc); |
| 1125 | |||
| 1126 | out: | ||
| 1119 | mutex_unlock(&monc->mutex); | 1127 | mutex_unlock(&monc->mutex); |
| 1120 | } | 1128 | } |
| 1121 | 1129 | ||
| @@ -1232,13 +1240,15 @@ EXPORT_SYMBOL(ceph_monc_init); · 110 unmodified lines | |||
| 1232 | void ceph_monc_stop(struct ceph_mon_client *monc) | 1240 | void ceph_monc_stop(struct ceph_mon_client *monc) |
| 1233 | { | 1241 | { |
| 1234 | dout("stop\n"); | 1242 | dout("stop\n"); |
| 1235 | cancel_delayed_work_sync(&monc->delayed_work); | ||
| 1236 | 1243 | ||
| 1237 | mutex_lock(&monc->mutex); | 1244 | mutex_lock(&monc->mutex); |
| 1238 | __close_session(monc); | 1245 | __close_session(monc); |
| 1246 | monc->hunting = false; | ||
| 1239 | monc->cur_mon = -1; | 1247 | monc->cur_mon = -1; |
| 1240 | mutex_unlock(&monc->mutex); | 1248 | mutex_unlock(&monc->mutex); |
| 1241 | 1249 | ||
| 1250 | cancel_delayed_work_sync(&monc->delayed_work); | ||
| 1251 | |||
| 1242 | /* | 1252 | /* |
| 1243 | * flush msgr queue before we destroy ourselves to ensure that: | 1253 | * flush msgr queue before we destroy ourselves to ensure that: |
| 1244 | * - any work that references our embedded con is finished. | 1254 | * - any work that references our embedded con is finished. |