From 1295dad5470bd512a24e78037b60c8c9ba54580e Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Mon, 5 Oct 2015 18:00:54 +0200
Subject: [PATCH] target/rbd: fix COMPARE AND WRITE page vector leak
Patch-mainline: Not yet, SES2 clustered LIO/RBD
References: bnc#948831

The COMPARE AND WRITE response page vector should be freed in the image
response completion callback.

Signed-off-by: David Disseldorp <ddiss@suse.de>
---
 drivers/target/target_core_rbd.c |    5 +++++
 drivers/target/target_core_rbd.h |    1 +
 2 files changed, 6 insertions(+)

--- a/drivers/target/target_core_rbd.c
+++ b/drivers/target/target_core_rbd.c
@@ -410,6 +410,10 @@ static void tcm_rbd_cmp_and_write_callba
 	}
 	kfree(tcm_rbd_dev->cmp_and_write_sg);
 	tcm_rbd_dev->cmp_and_write_sg = NULL;
+	ceph_release_page_vector(tcm_rbd_dev->cmp_and_write_pages,
+				 tcm_rbd_dev->cmp_and_write_page_count);
+	tcm_rbd_dev->cmp_and_write_pages = NULL;
+	tcm_rbd_dev->cmp_and_write_page_count = 0;
 	up(&dev->caw_sem);
 
 	if (sense_reason != TCM_NO_SENSE) {
@@ -465,6 +469,7 @@ static sense_reason_t tcm_rbd_execute_cm
 	if (IS_ERR(pages))
 		goto free_write_sg;
 	tcm_rbd_dev->cmp_and_write_pages = pages;
+	tcm_rbd_dev->cmp_and_write_page_count = page_count;
 
 	ret = rbd_img_cmp_and_write_request_fill(img_request, cmd->t_data_sg,
 						 len,
--- a/drivers/target/target_core_rbd.h
+++ b/drivers/target/target_core_rbd.h
@@ -13,6 +13,7 @@ struct tcm_rbd_dev {
 
 	struct scatterlist *cmp_and_write_sg;
 	struct page **cmp_and_write_pages;
+	u32 cmp_and_write_page_count;
 
 	unsigned char bd_udev_path[SE_UDEV_PATH_LEN];
 	u32 bd_flags;