Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph...

Pull Ceph fixes form Sage Weil:
 "There are two fixes in the messenger code, one that can trigger a NULL
  dereference, and one that error in refcounting (extra put).  There is
  also a trivial fix that in the fs client code that is triggered by NFS
  reexport."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  ceph: fix dentry reference leak in encode_fh()
  libceph: avoid NULL kref_put when osd reset races with alloc_msg
  rbd: reset BACKOFF if unable to re-queue

diff --combined fs/ceph/export.c
index 02ce909,8628870..9349bb3
--- 1/fs/ceph/export.c
--- 2/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@@ -90,6 -90,8 +90,8 @@@ static int ceph_encode_fh(struct inode 
                *max_len = handle_length;
                type = 255;
        }
+       if (dentry)
+               dput(dentry);
        return type;
  }
  
@@@ -99,7 -101,7 +101,7 @@@
   * FIXME: we should try harder by querying the mds for the ino.
   */
  static struct dentry *__fh_to_dentry(struct super_block *sb,
 -                                   struct ceph_nfs_fh *fh)
 +                                   struct ceph_nfs_fh *fh, int fh_len)
  {
        struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
        struct inode *inode;
@@@ -107,9 -109,6 +109,9 @@@
        struct ceph_vino vino;
        int err;
  
 +      if (fh_len < sizeof(*fh) / 4)
 +              return ERR_PTR(-ESTALE);
 +
        dout("__fh_to_dentry %llx\n", fh->ino);
        vino.ino = fh->ino;
        vino.snap = CEPH_NOSNAP;
@@@ -153,7 -152,7 +155,7 @@@
   * convert connectable fh to dentry
   */
  static struct dentry *__cfh_to_dentry(struct super_block *sb,
 -                                    struct ceph_nfs_confh *cfh)
 +                                    struct ceph_nfs_confh *cfh, int fh_len)
  {
        struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
        struct inode *inode;
@@@ -161,9 -160,6 +163,9 @@@
        struct ceph_vino vino;
        int err;
  
 +      if (fh_len < sizeof(*cfh) / 4)
 +              return ERR_PTR(-ESTALE);
 +
        dout("__cfh_to_dentry %llx (%llx/%x)\n",
             cfh->ino, cfh->parent_ino, cfh->parent_name_hash);
  
@@@ -213,11 -209,9 +215,11 @@@ static struct dentry *ceph_fh_to_dentry
                                        int fh_len, int fh_type)
  {
        if (fh_type == 1)
 -              return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw);
 +              return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw,
 +                                                              fh_len);
        else
 -              return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw);
 +              return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw,
 +                                                              fh_len);
  }
  
  /*
@@@ -238,8 -232,6 +240,8 @@@ static struct dentry *ceph_fh_to_parent
  
        if (fh_type == 1)
                return ERR_PTR(-ESTALE);
 +      if (fh_len < sizeof(*cfh) / 4)
 +              return ERR_PTR(-ESTALE);
  
        pr_debug("fh_to_parent %llx/%d\n", cfh->parent_ino,
                 cfh->parent_name_hash);