diff --git a/[refs] b/[refs]
index 60fd974240c8..fbd732e85adb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6e584f5244060edc77141700d814a2af7d697685
+refs/heads/master: f40eb349e032bee2b6f06e9b6f1dbfae561bd30a
diff --git a/trunk/drivers/block/rbd.c b/trunk/drivers/block/rbd.c
index c15bb3f5ebfb..21e84a15ae4c 100644
--- a/trunk/drivers/block/rbd.c
+++ b/trunk/drivers/block/rbd.c
@@ -2614,7 +2614,8 @@ static int rbd_dev_header_watch_sync(struct rbd_device *rbd_dev, int start)
 }
 
 /*
- * Synchronous osd object method call
+ * Synchronous osd object method call.  Returns the number of bytes
+ * returned in the outbound buffer, or a negative error code.
  */
 static int rbd_obj_method_sync(struct rbd_device *rbd_dev,
 			     const char *object_name,
@@ -3741,7 +3742,8 @@ static char *rbd_dev_image_name(struct rbd_device *rbd_dev)
 	if (ret < 0)
 		goto out;
 	p = reply_buf;
-	end = reply_buf + size;
+	end = reply_buf + ret;
+
 	image_name = ceph_extract_encoded_string(&p, end, &len, GFP_KERNEL);
 	if (IS_ERR(image_name))
 		image_name = NULL;
@@ -3914,26 +3916,23 @@ static char *rbd_dev_v2_snap_name(struct rbd_device *rbd_dev, u32 which)
 				&snap_id, sizeof (snap_id),
 				reply_buf, size, NULL);
 	dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
-	if (ret < 0)
+	if (ret < 0) {
+		snap_name = ERR_PTR(ret);
 		goto out;
+	}
 
 	p = reply_buf;
-	end = reply_buf + size;
+	end = reply_buf + ret;
 	snap_name = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
-	if (IS_ERR(snap_name)) {
-		ret = PTR_ERR(snap_name);
+	if (IS_ERR(snap_name))
 		goto out;
-	} else {
-		dout("  snap_id 0x%016llx snap_name = %s\n",
-			(unsigned long long)le64_to_cpu(snap_id), snap_name);
-	}
-	kfree(reply_buf);
 
-	return snap_name;
+	dout("  snap_id 0x%016llx snap_name = %s\n",
+		(unsigned long long)le64_to_cpu(snap_id), snap_name);
 out:
 	kfree(reply_buf);
 
-	return ERR_PTR(ret);
+	return snap_name;
 }
 
 static char *rbd_dev_v2_snap_info(struct rbd_device *rbd_dev, u32 which,