From a518acb9f08325569e310662411c3d4b9105d3e0 Mon Sep 17 00:00:00 2001
From: Alex Elder <elder@inktank.com>
Date: Mon, 9 Jul 2012 21:04:24 -0500
Subject: [PATCH] --- yaml --- r: 320321 b: refs/heads/master c:
 820a5f3e94b9f8ea8c0c6125ce34b237ed67b1dc h: refs/heads/master i:   320319:
 c5006ff5220de08442b32ada49eb9b0a361d0c48 v: v3

---
 [refs]                    |  2 +-
 trunk/drivers/block/rbd.c | 26 ++++++++++++++++----------
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/[refs] b/[refs]
index 5caff9eb3e2b..a7ff15d7a6de 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bf3e5ae1129ef18a702c14fbaac27aeb2fe25e62
+refs/heads/master: 820a5f3e94b9f8ea8c0c6125ce34b237ed67b1dc
diff --git a/trunk/drivers/block/rbd.c b/trunk/drivers/block/rbd.c
index 7d4735c9dba5..5c0f0445982c 100644
--- a/trunk/drivers/block/rbd.c
+++ b/trunk/drivers/block/rbd.c
@@ -172,7 +172,7 @@ struct rbd_device {
 
 	/* protects updating the header */
 	struct rw_semaphore     header_rwsem;
-	char                    snap_name[RBD_MAX_SNAP_NAME_LEN];
+	char                    *snap_name;
 	u64                     snap_id;	/* current snapshot id */
 	int read_only;
 
@@ -588,8 +588,6 @@ static int rbd_header_set_snap(struct rbd_device *dev, u64 *size)
 	struct ceph_snap_context *snapc = header->snapc;
 	int ret = -ENOENT;
 
-	BUILD_BUG_ON(sizeof (dev->snap_name) < sizeof (RBD_SNAP_HEAD_NAME));
-
 	down_write(&dev->header_rwsem);
 
 	if (!memcmp(dev->snap_name, RBD_SNAP_HEAD_NAME,
@@ -2390,16 +2388,22 @@ static int rbd_add_parse_args(struct rbd_device *rbd_dev,
 	sprintf(rbd_dev->obj_md_name, "%s%s", rbd_dev->obj, RBD_SUFFIX);
 
 	/*
-	 * The snapshot name is optional, but it's an error if it's
-	 * too long.  If no snapshot is supplied, fill in the default.
+	 * The snapshot name is optional.  If none is is supplied,
+	 * we use the default value.
 	 */
-	len = copy_token(&buf, rbd_dev->snap_name, sizeof (rbd_dev->snap_name));
-	if (!len)
+	rbd_dev->snap_name = dup_token(&buf, &len);
+	if (!rbd_dev->snap_name)
+		goto out_err;
+	if (!len) {
+		/* Replace the empty name with the default */
+		kfree(rbd_dev->snap_name);
+		rbd_dev->snap_name
+			= kmalloc(sizeof (RBD_SNAP_HEAD_NAME), GFP_KERNEL);
+		if (!rbd_dev->snap_name)
+			goto out_err;
+
 		memcpy(rbd_dev->snap_name, RBD_SNAP_HEAD_NAME,
 			sizeof (RBD_SNAP_HEAD_NAME));
-	else if (len >= sizeof (rbd_dev->snap_name)) {
-		ret = -EINVAL;
-		goto out_err;
 	}
 
 	return 0;
@@ -2509,6 +2513,7 @@ static ssize_t rbd_add(struct bus_type *bus,
 	rbd_put_client(rbd_dev);
 err_put_id:
 	if (rbd_dev->pool_name) {
+		kfree(rbd_dev->snap_name);
 		kfree(rbd_dev->obj_md_name);
 		kfree(rbd_dev->obj);
 		kfree(rbd_dev->pool_name);
@@ -2561,6 +2566,7 @@ static void rbd_dev_release(struct device *dev)
 	unregister_blkdev(rbd_dev->major, rbd_dev->name);
 
 	/* done with the id, and with the rbd_dev */
+	kfree(rbd_dev->snap_name);
 	kfree(rbd_dev->obj_md_name);
 	kfree(rbd_dev->pool_name);
 	kfree(rbd_dev->obj);