From: Sage Weil <sage@newdream.net>
Date: Wed, 7 Jan 2009 21:53:28 +0000 (-0800)
Subject: kclient: fix request ref count leak from duplicate replies
X-Git-Tag: v0.6~1^2~145
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=638a76aab5bae2a9d391908c046c7842f7f66610;p=ceph.git

kclient: fix request ref count leak from duplicate replies
---

diff --git a/src/kernel/mds_client.c b/src/kernel/mds_client.c
index a4a803fa416a..098409d66752 100644
--- a/src/kernel/mds_client.c
+++ b/src/kernel/mds_client.c
@@ -368,6 +368,8 @@ static void unregister_session(struct ceph_mds_client *mdsc, int mds)
  */
 static void get_request(struct ceph_mds_request *req)
 {
+	dout(10, "get_request %p %d -> %d\n", req, 
+	     atomic_read(&req->r_ref), atomic_read(&req->r_ref)+1);
 	atomic_inc(&req->r_ref);
 }
 
@@ -414,7 +416,7 @@ void ceph_mdsc_put_request(struct ceph_mds_request *req)
  *
  * called under mdsc->mutex.
  */
-static struct ceph_mds_request *__get_request(struct ceph_mds_client *mdsc,
+static struct ceph_mds_request *__lookup_request(struct ceph_mds_client *mdsc,
 					     u64 tid)
 {
 	struct ceph_mds_request *req;
@@ -1298,7 +1300,7 @@ void ceph_mdsc_handle_reply(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
 	/* get request, session */
 	tid = le64_to_cpu(head->tid);
 	mutex_lock(&mdsc->mutex);
-	req = __get_request(mdsc, tid);
+	req = __lookup_request(mdsc, tid);
 	if (!req) {
 		dout(1, "handle_reply on unknown tid %llu\n", tid);
 		mutex_unlock(&mdsc->mutex);
@@ -1310,6 +1312,7 @@ void ceph_mdsc_handle_reply(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
 		derr(1, "got reply on %llu, mds%d got more than one reply\n",
 		     tid, mds);
 		mutex_unlock(&mdsc->mutex);
+		ceph_mdsc_put_request(req);
 		return;
 	}
 	if (req->r_session && req->r_session->s_mds != mds) {
@@ -1408,7 +1411,7 @@ void ceph_mdsc_handle_forward(struct ceph_mds_client *mdsc,
 	ceph_decode_8(&p, must_resend);
 
 	mutex_lock(&mdsc->mutex);
-	req = __get_request(mdsc, tid);
+	req = __lookup_request(mdsc, tid);
 	if (!req) {
 		dout(10, "forward %llu dne\n", tid);
 		goto out;  /* dup reply? */