Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18741196 authored by Dan Carpenter's avatar Dan Carpenter Committed by Sage Weil
Browse files

libceph: fix error handling in handle_reply() 



We've tried to fix the error paths in this function before, but there
is still a hidden goto in the ceph_decode_need() macro which goes to the
wrong place.  We need to release the "req" and unlock a mutex before
returning.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarSage Weil <sage@inktank.com>
parent b314a90d

net/ceph/osd_client.c

+3 −3
Original line number Diff line number Diff line
@@ -1495,14 +1495,14 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg, 
	dout("handle_reply %p tid %llu req %p result %d\n", msg, tid,

	     req, result);



	ceph_decode_need(&p, end, 4, bad);

	ceph_decode_need(&p, end, 4, bad_put);

	numops = ceph_decode_32(&p);

	if (numops > CEPH_OSD_MAX_OP)

		goto bad_put;

	if (numops != req->r_num_ops)

		goto bad_put;

	payload_len = 0;

	ceph_decode_need(&p, end, numops * sizeof(struct ceph_osd_op), bad);

	ceph_decode_need(&p, end, numops * sizeof(struct ceph_osd_op), bad_put);

	for (i = 0; i < numops; i++) {

		struct ceph_osd_op *op = p;

		int len;
@@ -1520,7 +1520,7 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg, 
		goto bad_put;

	}



	ceph_decode_need(&p, end, 4 + numops * 4, bad);

	ceph_decode_need(&p, end, 4 + numops * 4, bad_put);

	retry_attempt = ceph_decode_32(&p);

	for (i = 0; i < numops; i++)

		req->r_reply_op_result[i] = ceph_decode_32(&p);