Merge tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "Two small fixes from Xiubo and myself, marked for stable"

* tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client:
  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  ceph: update the time stamps and try to drop the suid/sgid

diff --combined drivers/block/rbd.c
index 1faca7e07a4d52b9330995f23a8f6eaa98c73998,60aed196a2e5452957e7797f94fc630cfc7869ad..5cb008b9700a01dbe7d067854d3b1b2b3dc7c89b
--- 1/drivers/block/rbd.c
--- 2/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@@ -3068,12 -3068,13 +3068,12 @@@ static int setup_copyup_bvecs(struct rb
  
        for (i = 0; i < obj_req->copyup_bvec_count; i++) {
                unsigned int len = min(obj_overlap, (u64)PAGE_SIZE);
 +              struct page *page = alloc_page(GFP_NOIO);
  
 -              obj_req->copyup_bvecs[i].bv_page = alloc_page(GFP_NOIO);
 -              if (!obj_req->copyup_bvecs[i].bv_page)
 +              if (!page)
                        return -ENOMEM;
  
 -              obj_req->copyup_bvecs[i].bv_offset = 0;
 -              obj_req->copyup_bvecs[i].bv_len = len;
 +              bvec_set_page(&obj_req->copyup_bvecs[i], page, len, 0);
                obj_overlap -= len;
        }
  
@@@ -5291,8 -5292,7 +5291,7 @@@ static void rbd_dev_release(struct devi
                module_put(THIS_MODULE);
  }
  
- static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc,
-                                          struct rbd_spec *spec)
+ static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec)
  {
        struct rbd_device *rbd_dev;
  
@@@ -5337,9 -5337,6 +5336,6 @@@
        rbd_dev->dev.parent = &rbd_root_dev;
        device_initialize(&rbd_dev->dev);
  
-       rbd_dev->rbd_client = rbdc;
-       rbd_dev->spec = spec;
- 
        return rbd_dev;
  }
  
@@@ -5352,12 -5349,10 +5348,10 @@@ static struct rbd_device *rbd_dev_creat
  {
        struct rbd_device *rbd_dev;
  
-       rbd_dev = __rbd_dev_create(rbdc, spec);
+       rbd_dev = __rbd_dev_create(spec);
        if (!rbd_dev)
                return NULL;
  
-       rbd_dev->opts = opts;
- 
        /* get an id and fill in device name */
        rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0,
                                         minor_to_rbd_dev_id(1 << MINORBITS),
@@@ -5374,6 -5369,10 +5368,10 @@@
        /* we have a ref from do_rbd_add() */
        __module_get(THIS_MODULE);
  
+       rbd_dev->rbd_client = rbdc;
+       rbd_dev->spec = spec;
+       rbd_dev->opts = opts;
+ 
        dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id);
        return rbd_dev;
  
@@@ -6735,7 -6734,7 +6733,7 @@@ static int rbd_dev_probe_parent(struct 
                goto out_err;
        }
  
-       parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
+       parent = __rbd_dev_create(rbd_dev->parent_spec);
        if (!parent) {
                ret = -ENOMEM;
                goto out_err;
@@@ -6745,8 -6744,8 +6743,8 @@@
         * Images related by parent/child relationships always share
         * rbd_client and spec/parent_spec, so bump their refcounts.
         */
-       __rbd_get_client(rbd_dev->rbd_client);
-       rbd_spec_get(rbd_dev->parent_spec);
+       parent->rbd_client = __rbd_get_client(rbd_dev->rbd_client);
+       parent->spec = rbd_spec_get(rbd_dev->parent_spec);
  
        __set_bit(RBD_DEV_FLAG_READONLY, &parent->flags);
  

diff --combined fs/ceph/file.c
index 5dcc62e678c480acac3dd467aab1dd55bfad18b1,dc39a4b0ec8ecf62cd8c0f7e696dbb25639858bf..f4d8bf7dec88a8eddeffbb0de171514566c6fa21
--- 1/fs/ceph/file.c
--- 2/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@@ -103,10 -103,14 +103,10 @@@ static ssize_t __iter_get_bvecs(struct 
                size += bytes;
  
                for ( ; bytes; idx++, bvec_idx++) {
 -                      struct bio_vec bv = {
 -                              .bv_page = pages[idx],
 -                              .bv_len = min_t(int, bytes, PAGE_SIZE - start),
 -                              .bv_offset = start,
 -                      };
 -
 -                      bvecs[bvec_idx] = bv;
 -                      bytes -= bv.bv_len;
 +                      int len = min_t(int, bytes, PAGE_SIZE - start);
 +
 +                      bvec_set_page(&bvecs[bvec_idx], pages[idx], len, start);
 +                      bytes -= len;
                        start = 0;
                }
        }
@@@ -2098,6 -2102,9 +2098,9 @@@ static long ceph_fallocate(struct file 
        loff_t endoff = 0;
        loff_t size;
  
+       dout("%s %p %llx.%llx mode %x, offset %llu length %llu\n", __func__,
+            inode, ceph_vinop(inode), mode, offset, length);
+ 
        if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
                return -EOPNOTSUPP;
  
@@@ -2132,6 -2139,10 +2135,10 @@@
        if (ret < 0)
                goto unlock;
  
+       ret = file_modified(file);
+       if (ret)
+               goto put_caps;
+ 
        filemap_invalidate_lock(inode->i_mapping);
        ceph_fscache_invalidate(inode, false);
        ceph_zero_pagecache_range(inode, offset, length);
@@@ -2147,6 -2158,7 +2154,7 @@@
        }
        filemap_invalidate_unlock(inode->i_mapping);
  
+ put_caps:
        ceph_put_cap_refs(ci, got);
  unlock:
        inode_unlock(inode);