From 6c80207392fdb86107d7acbdbf4c86cac38da1af Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 16:28:07 +0000 Subject: [PATCH] ceph: Fix mds session leak in __open_export_target_session() __open_export_target_session() holds a reference on the target session, either from __ceph_lookup_mds_session() or from register_session(), which the caller is expected to drop. When __open_session() fails, the helper returns ERR_PTR(ret) without dropping that reference, leaking one session reference on every open failure. Drop the session reference before returning the error. Cc: stable@vger.kernel.org Fixes: b682c6d41bc2 ("ceph: switch to WARN_ON_ONCE in encode_supported_features()") Signed-off-by: Wentao Liang Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- fs/ceph/mds_client.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 98c8736cced2..a207b342e7da 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -1828,8 +1828,10 @@ __open_export_target_session(struct ceph_mds_client *mdsc, int target) if (session->s_state == CEPH_MDS_SESSION_NEW || session->s_state == CEPH_MDS_SESSION_CLOSING) { ret = __open_session(mdsc, session); - if (ret) + if (ret) { + ceph_put_mds_session(session); return ERR_PTR(ret); + } } return session;