libceph: fix a osd request memory leak
If an invalid layout is provided to ceph_osdc_new_request(), its
call to calc_layout() might return an error. At that point in the
function we've already allocated an osd request structure, so we
need to free it (drop a reference) in the event such an error
occurs.
The only other value calc_layout() will return is 0, so make that
explicit in the successful case.
This resolves:
http://tracker.ceph.com/issues/4240
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index d730dd4..cf4e15b 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -109,7 +109,7 @@
snprintf(req->r_oid, sizeof(req->r_oid), "%llx.%08llx", vino.ino, bno);
req->r_oid_len = strlen(req->r_oid);
- return r;
+ return 0;
}
/*
@@ -470,8 +470,10 @@
/* calculate max write size */
r = calc_layout(vino, layout, off, plen, req, ops);
- if (r < 0)
+ if (r < 0) {
+ ceph_osdc_put_request(req);
return ERR_PTR(r);
+ }
req->r_file_layout = *layout; /* keep a copy */
/* in case it differs from natural (file) alignment that