From 2601725fbf2ceea62096dd2f225f8d9fa2467383 Mon Sep 17 00:00:00 2001 From: Sun Yuechi Date: Tue, 30 Jun 2026 19:37:00 +0800 Subject: [PATCH] mds/Server: return after responding on error paths handle_client_symlink (-ENAMETOOLONG), reclaim_session (-EPERM) and handle_client_readdir_snapdiff (-EINVAL) each sent an error reply on a failure path but fell through, replying to the same MDRequest a second time. reclaim_session additionally went on to bind reclaiming_from, bypassing the auth_name check. Return right after sending the reply. Fixes: https://tracker.ceph.com/issues/77862 Signed-off-by: Sun Yuechi --- src/mds/Server.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/mds/Server.cc b/src/mds/Server.cc index 688c21d3364..f345134ff32 100644 --- a/src/mds/Server.cc +++ b/src/mds/Server.cc @@ -501,6 +501,7 @@ void Server::reclaim_session(Session *session, const cref_t &m) << " != target auth_name " << target->info.auth_name << dendl; reply->set_result(-EPERM); mds->send_message_client(reply, session); + return; } ceph_assert(!target->reclaiming_from); @@ -7700,6 +7701,7 @@ void Server::handle_client_symlink(const MDRequestRef& mdr) if (req->get_alternate_name().size() > alternate_name_max) { dout(10) << " alternate_name longer than " << alternate_name_max << dendl; respond_to_request(mdr, -ENAMETOOLONG); + return; } dn->set_alternate_name(req->get_alternate_name()); @@ -12111,6 +12113,7 @@ void Server::handle_client_readdir_snapdiff(const MDRequestRef& mdr) mdr->snapid_diff_other == CEPH_NOSNAP) { dout(10) << "reply to " << *req << " snapdiff -EINVAL" << dendl; respond_to_request(mdr, -EINVAL); + return; } unsigned max = req->head.args.snapdiff.max_entries;