[PATCH 0/2] libceph: fix potential use-after-free in have_mon_and_osd_map()

[PATCH 0/2] libceph: fix potential use-after-free in have_mon_and_osd_map()

[Ilya Dryomov]

Hello,

As requested by Slava in [1], here is my version of the patch.

[1] https://lore.kernel.org/ceph-devel/5e6418fa61bce3f165ffe3b6b3a2ea5a9323b2c7.camel@ibm.com/

Thanks,

                Ilya


Ilya Dryomov (2):
  libceph: fix potential use-after-free in have_mon_and_osd_map()
  libceph: drop started parameter of __ceph_open_session()

 fs/ceph/super.c              |  2 +-
 include/linux/ceph/libceph.h |  3 +-
 net/ceph/ceph_common.c       | 58 +++++++++++++++++++++---------------
 net/ceph/debugfs.c           | 14 ++++++---
 4 files changed, 46 insertions(+), 31 deletions(-)

-- 
2.49.0

[PATCH 1/2] libceph: fix potential use-after-free in have_mon_and_osd_map()

[Ilya Dryomov]

The wait loop in __ceph_open_session() can race with the client
receiving a new monmap or osdmap shortly after the initial map is
received.  Both ceph_monc_handle_map() and handle_one_map() install
a new map immediately after freeing the old one

    kfree(monc->monmap);
    monc->monmap = monmap;

    ceph_osdmap_destroy(osdc->osdmap);
    osdc->osdmap = newmap;

under client->monc.mutex and client->osdc.lock respectively, but
because neither is taken in have_mon_and_osd_map() it's possible for
client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in

    client->monc.monmap && client->monc.monmap->epoch &&
        client->osdc.osdmap && client->osdc.osdmap->epoch;

condition to dereference an already freed map.  This happens to be
reproducible with generic/395 and generic/397 with KASAN enabled:

    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
    ...
    Call Trace:
    <TASK>
    have_mon_and_osd_map+0x56/0x70
    ceph_open_session+0x182/0x290
    ceph_get_tree+0x333/0x680
    vfs_get_tree+0x49/0x180
    do_new_mount+0x1a3/0x2d0
    path_mount+0x6dd/0x730
    do_mount+0x99/0xe0
    __do_sys_mount+0x141/0x180
    do_syscall_64+0x9f/0x100
    entry_SYSCALL_64_after_hwframe+0x76/0x7e
    </TASK>

    Allocated by task 13305:
    ceph_osdmap_alloc+0x16/0x130
    ceph_osdc_init+0x27a/0x4c0
    ceph_create_client+0x153/0x190
    create_fs_client+0x50/0x2a0
    ceph_get_tree+0xff/0x680
    vfs_get_tree+0x49/0x180
    do_new_mount+0x1a3/0x2d0
    path_mount+0x6dd/0x730
    do_mount+0x99/0xe0
    __do_sys_mount+0x141/0x180
    do_syscall_64+0x9f/0x100
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

    Freed by task 9475:
    kfree+0x212/0x290
    handle_one_map+0x23c/0x3b0
    ceph_osdc_handle_map+0x3c9/0x590
    mon_dispatch+0x655/0x6f0
    ceph_con_process_message+0xc3/0xe0
    ceph_con_v1_try_read+0x614/0x760
    ceph_con_workfn+0x2de/0x650
    process_one_work+0x486/0x7c0
    process_scheduled_works+0x73/0x90
    worker_thread+0x1c8/0x2a0
    kthread+0x2ec/0x300
    ret_from_fork+0x24/0x40
    ret_from_fork_asm+0x1a/0x30

Rewrite the wait loop to check the above condition directly with
client->monc.mutex and client->osdc.lock taken as appropriate.  While
at it, improve the timeout handling (previously mount_timeout could be
exceeded in case wait_event_interruptible_timeout() slept more than
once) and access client->auth_err under client->monc.mutex to match
how it's set in finish_auth().

monmap_show() and osdmap_show() now take the respective lock before
accessing the map as well.

Cc: stable@vger.kernel.org
Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++-----------------
 net/ceph/debugfs.c     | 14 +++++++----
 2 files changed, 42 insertions(+), 25 deletions(-)

diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 4c6441536d55..285e981730e5 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -785,42 +785,53 @@ void ceph_reset_client_addr(struct ceph_client *client)
 }
 EXPORT_SYMBOL(ceph_reset_client_addr);
 
-/*
- * true if we have the mon map (and have thus joined the cluster)
- */
-static bool have_mon_and_osd_map(struct ceph_client *client)
-{
-	return client->monc.monmap && client->monc.monmap->epoch &&
-	       client->osdc.osdmap && client->osdc.osdmap->epoch;
-}
-
 /*
  * mount: join the ceph cluster, and open root directory.
  */
 int __ceph_open_session(struct ceph_client *client, unsigned long started)
 {
-	unsigned long timeout = client->options->mount_timeout;
-	long err;
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
+	bool have_monmap, have_osdmap;
+	int err;
 
 	/* open session, and wait for mon and osd maps */
 	err = ceph_monc_open_session(&client->monc);
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
-		err = wait_event_interruptible_timeout(client->auth_wq,
-			have_mon_and_osd_map(client) || (client->auth_err < 0),
-			ceph_timeout_jiffies(timeout));
-		if (err < 0)
-			return err;
-		if (client->auth_err < 0)
-			return client->auth_err;
+		timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
 	}
+	remove_wait_queue(&client->auth_wq, &wait);
+
+	if (err)
+		return err;
 
 	pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
 		&client->fsid);
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 2110439f8a24..83c270bce63c 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *s, void *p)
 	int i;
 	struct ceph_client *client = s->private;
 
+	mutex_lock(&client->monc.mutex);
 	if (client->monc.monmap == NULL)
-		return 0;
+		goto out_unlock;
 
 	seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
 	for (i = 0; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *s, void *p)
 			   ENTITY_NAME(inst->name),
 			   ceph_pr_addr(&inst->addr));
 	}
+
+out_unlock:
+	mutex_unlock(&client->monc.mutex);
 	return 0;
 }
 
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *s, void *p)
 	int i;
 	struct ceph_client *client = s->private;
 	struct ceph_osd_client *osdc = &client->osdc;
-	struct ceph_osdmap *map = osdc->osdmap;
+	struct ceph_osdmap *map;
 	struct rb_node *n;
 
+	down_read(&osdc->lock);
+	map = osdc->osdmap;
 	if (map == NULL)
-		return 0;
+		goto out_unlock;
 
-	down_read(&osdc->lock);
 	seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
 			osdc->epoch_barrier, map->flags);
 
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *s, void *p)
 		seq_printf(s, "]\n");
 	}
 
+out_unlock:
 	up_read(&osdc->lock);
 	return 0;
 }
-- 
2.49.0

[PATCH 2/2] libceph: drop started parameter of __ceph_open_session()

[Ilya Dryomov]

With the previous commit revamping the timeout handling, started isn't
used anymore.  It could be taken into account by adjusting the initial
value of the timeout, but there is little point as both callers capture
the timestamp shortly before calling __ceph_open_session() -- the only
thing of note that happens in the interim is taking client->mount_mutex
and that isn't expected to take multiple seconds.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 fs/ceph/super.c              | 2 +-
 include/linux/ceph/libceph.h | 3 +--
 net/ceph/ceph_common.c       | 5 ++---
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 48f184aea1bb..20cb336ebc9f 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -1152,7 +1152,7 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc,
 		const char *path = fsc->mount_options->server_path ?
 				     fsc->mount_options->server_path + 1 : "";
 
-		err = __ceph_open_session(fsc->client, started);
+		err = __ceph_open_session(fsc->client);
 		if (err < 0)
 			goto out;
 
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
index 733e7f93db66..63e0e2aa1ce9 100644
--- a/include/linux/ceph/libceph.h
+++ b/include/linux/ceph/libceph.h
@@ -306,8 +306,7 @@ struct ceph_entity_addr *ceph_client_addr(struct ceph_client *client);
 u64 ceph_client_gid(struct ceph_client *client);
 extern void ceph_destroy_client(struct ceph_client *client);
 extern void ceph_reset_client_addr(struct ceph_client *client);
-extern int __ceph_open_session(struct ceph_client *client,
-			       unsigned long started);
+extern int __ceph_open_session(struct ceph_client *client);
 extern int ceph_open_session(struct ceph_client *client);
 int ceph_wait_for_latest_osdmap(struct ceph_client *client,
 				unsigned long timeout);
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 285e981730e5..e734e57be083 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -788,7 +788,7 @@ EXPORT_SYMBOL(ceph_reset_client_addr);
 /*
  * mount: join the ceph cluster, and open root directory.
  */
-int __ceph_open_session(struct ceph_client *client, unsigned long started)
+int __ceph_open_session(struct ceph_client *client)
 {
 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
@@ -844,12 +844,11 @@ EXPORT_SYMBOL(__ceph_open_session);
 int ceph_open_session(struct ceph_client *client)
 {
 	int ret;
-	unsigned long started = jiffies;  /* note the start time */
 
 	dout("open_session start\n");
 	mutex_lock(&client->mount_mutex);
 
-	ret = __ceph_open_session(client, started);
+	ret = __ceph_open_session(client);
 
 	mutex_unlock(&client->mount_mutex);
 	return ret;
-- 
2.49.0

Re: [PATCH 1/2] libceph: fix potential use-after-free in have_mon_and_osd_map()

[Viacheslav Dubeyko]

On Mon, 2025-11-03 at 22:53 +0100, Ilya Dryomov wrote:
> The wait loop in __ceph_open_session() can race with the client
> receiving a new monmap or osdmap shortly after the initial map is
> received.  Both ceph_monc_handle_map() and handle_one_map() install
> a new map immediately after freeing the old one
> 
>     kfree(monc->monmap);
>     monc->monmap = monmap;
> 
>     ceph_osdmap_destroy(osdc->osdmap);
>     osdc->osdmap = newmap;
> 
> under client->monc.mutex and client->osdc.lock respectively, but
> because neither is taken in have_mon_and_osd_map() it's possible for
> client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in
> 
>     client->monc.monmap && client->monc.monmap->epoch &&
>         client->osdc.osdmap && client->osdc.osdmap->epoch;
> 
> condition to dereference an already freed map.  This happens to be
> reproducible with generic/395 and generic/397 with KASAN enabled:
> 
>     BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
>     Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
>     CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
>     ...
>     Call Trace:
>     <TASK>
>     have_mon_and_osd_map+0x56/0x70
>     ceph_open_session+0x182/0x290
>     ceph_get_tree+0x333/0x680
>     vfs_get_tree+0x49/0x180
>     do_new_mount+0x1a3/0x2d0
>     path_mount+0x6dd/0x730
>     do_mount+0x99/0xe0
>     __do_sys_mount+0x141/0x180
>     do_syscall_64+0x9f/0x100
>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
>     </TASK>
> 
>     Allocated by task 13305:
>     ceph_osdmap_alloc+0x16/0x130
>     ceph_osdc_init+0x27a/0x4c0
>     ceph_create_client+0x153/0x190
>     create_fs_client+0x50/0x2a0
>     ceph_get_tree+0xff/0x680
>     vfs_get_tree+0x49/0x180
>     do_new_mount+0x1a3/0x2d0
>     path_mount+0x6dd/0x730
>     do_mount+0x99/0xe0
>     __do_sys_mount+0x141/0x180
>     do_syscall_64+0x9f/0x100
>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
>     Freed by task 9475:
>     kfree+0x212/0x290
>     handle_one_map+0x23c/0x3b0
>     ceph_osdc_handle_map+0x3c9/0x590
>     mon_dispatch+0x655/0x6f0
>     ceph_con_process_message+0xc3/0xe0
>     ceph_con_v1_try_read+0x614/0x760
>     ceph_con_workfn+0x2de/0x650
>     process_one_work+0x486/0x7c0
>     process_scheduled_works+0x73/0x90
>     worker_thread+0x1c8/0x2a0
>     kthread+0x2ec/0x300
>     ret_from_fork+0x24/0x40
>     ret_from_fork_asm+0x1a/0x30
> 
> Rewrite the wait loop to check the above condition directly with
> client->monc.mutex and client->osdc.lock taken as appropriate.  While
> at it, improve the timeout handling (previously mount_timeout could be
> exceeded in case wait_event_interruptible_timeout() slept more than
> once) and access client->auth_err under client->monc.mutex to match
> how it's set in finish_auth().
> 
> monmap_show() and osdmap_show() now take the respective lock before
> accessing the map as well.
> 
> Cc: stable@vger.kernel.org
> Reported-by: David Howells <dhowells@redhat.com>
> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
> ---
>  net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++-----------------
>  net/ceph/debugfs.c     | 14 +++++++----
>  2 files changed, 42 insertions(+), 25 deletions(-)
> 
> diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
> index 4c6441536d55..285e981730e5 100644
> --- a/net/ceph/ceph_common.c
> +++ b/net/ceph/ceph_common.c
> @@ -785,42 +785,53 @@ void ceph_reset_client_addr(struct ceph_client *client)
>  }
>  EXPORT_SYMBOL(ceph_reset_client_addr);
>  
> -/*
> - * true if we have the mon map (and have thus joined the cluster)
> - */
> -static bool have_mon_and_osd_map(struct ceph_client *client)
> -{
> -	return client->monc.monmap && client->monc.monmap->epoch &&
> -	       client->osdc.osdmap && client->osdc.osdmap->epoch;
> -}
> -
>  /*
>   * mount: join the ceph cluster, and open root directory.
>   */
>  int __ceph_open_session(struct ceph_client *client, unsigned long started)
>  {
> -	unsigned long timeout = client->options->mount_timeout;
> -	long err;
> +	DEFINE_WAIT_FUNC(wait, woken_wake_function);
> +	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
> +	bool have_monmap, have_osdmap;
> +	int err;
>  
>  	/* open session, and wait for mon and osd maps */
>  	err = ceph_monc_open_session(&client->monc);
>  	if (err < 0)
>  		return err;
>  
> -	while (!have_mon_and_osd_map(client)) {
> -		if (timeout && time_after_eq(jiffies, started + timeout))
> -			return -ETIMEDOUT;
> +	add_wait_queue(&client->auth_wq, &wait);
> +	for (;;) {
> +		mutex_lock(&client->monc.mutex);
> +		err = client->auth_err;
> +		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
> +		mutex_unlock(&client->monc.mutex);
> +
> +		down_read(&client->osdc.lock);
> +		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
> +		up_read(&client->osdc.lock);
> +
> +		if (err || (have_monmap && have_osdmap))
> +			break;
> +
> +		if (signal_pending(current)) {
> +			err = -ERESTARTSYS;
> +			break;
> +		}
> +
> +		if (!timeout) {
> +			err = -ETIMEDOUT;
> +			break;
> +		}
>  
>  		/* wait */
>  		dout("mount waiting for mon_map\n");
> -		err = wait_event_interruptible_timeout(client->auth_wq,
> -			have_mon_and_osd_map(client) || (client->auth_err < 0),
> -			ceph_timeout_jiffies(timeout));
> -		if (err < 0)
> -			return err;
> -		if (client->auth_err < 0)
> -			return client->auth_err;
> +		timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
>  	}
> +	remove_wait_queue(&client->auth_wq, &wait);
> +
> +	if (err)
> +		return err;
>  
>  	pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
>  		&client->fsid);
> diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
> index 2110439f8a24..83c270bce63c 100644
> --- a/net/ceph/debugfs.c
> +++ b/net/ceph/debugfs.c
> @@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *s, void *p)
>  	int i;
>  	struct ceph_client *client = s->private;
>  
> +	mutex_lock(&client->monc.mutex);
>  	if (client->monc.monmap == NULL)
> -		return 0;
> +		goto out_unlock;
>  
>  	seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
>  	for (i = 0; i < client->monc.monmap->num_mon; i++) {
> @@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *s, void *p)
>  			   ENTITY_NAME(inst->name),
>  			   ceph_pr_addr(&inst->addr));
>  	}
> +
> +out_unlock:
> +	mutex_unlock(&client->monc.mutex);
>  	return 0;
>  }
>  
> @@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *s, void *p)
>  	int i;
>  	struct ceph_client *client = s->private;
>  	struct ceph_osd_client *osdc = &client->osdc;
> -	struct ceph_osdmap *map = osdc->osdmap;
> +	struct ceph_osdmap *map;
>  	struct rb_node *n;
>  
> +	down_read(&osdc->lock);
> +	map = osdc->osdmap;
>  	if (map == NULL)
> -		return 0;
> +		goto out_unlock;
>  
> -	down_read(&osdc->lock);
>  	seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
>  			osdc->epoch_barrier, map->flags);
>  
> @@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *s, void *p)
>  		seq_printf(s, "]\n");
>  	}
>  
> +out_unlock:
>  	up_read(&osdc->lock);
>  	return 0;
>  }

Looks good.

Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

Thanks,
Slava.

Re: [PATCH 2/2] libceph: drop started parameter of __ceph_open_session()

[Viacheslav Dubeyko]

On Mon, 2025-11-03 at 22:53 +0100, Ilya Dryomov wrote:
> With the previous commit revamping the timeout handling, started isn't
> used anymore.  It could be taken into account by adjusting the initial
> value of the timeout, but there is little point as both callers capture
> the timestamp shortly before calling __ceph_open_session() -- the only
> thing of note that happens in the interim is taking client->mount_mutex
> and that isn't expected to take multiple seconds.
> 
> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
> ---
>  fs/ceph/super.c              | 2 +-
>  include/linux/ceph/libceph.h | 3 +--
>  net/ceph/ceph_common.c       | 5 ++---
>  3 files changed, 4 insertions(+), 6 deletions(-)
> 
> diff --git a/fs/ceph/super.c b/fs/ceph/super.c
> index 48f184aea1bb..20cb336ebc9f 100644
> --- a/fs/ceph/super.c
> +++ b/fs/ceph/super.c
> @@ -1152,7 +1152,7 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc,
>  		const char *path = fsc->mount_options->server_path ?
>  				     fsc->mount_options->server_path + 1 : "";
>  
> -		err = __ceph_open_session(fsc->client, started);
> +		err = __ceph_open_session(fsc->client);
>  		if (err < 0)
>  			goto out;
>  
> diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
> index 733e7f93db66..63e0e2aa1ce9 100644
> --- a/include/linux/ceph/libceph.h
> +++ b/include/linux/ceph/libceph.h
> @@ -306,8 +306,7 @@ struct ceph_entity_addr *ceph_client_addr(struct ceph_client *client);
>  u64 ceph_client_gid(struct ceph_client *client);
>  extern void ceph_destroy_client(struct ceph_client *client);
>  extern void ceph_reset_client_addr(struct ceph_client *client);
> -extern int __ceph_open_session(struct ceph_client *client,
> -			       unsigned long started);
> +extern int __ceph_open_session(struct ceph_client *client);
>  extern int ceph_open_session(struct ceph_client *client);
>  int ceph_wait_for_latest_osdmap(struct ceph_client *client,
>  				unsigned long timeout);
> diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
> index 285e981730e5..e734e57be083 100644
> --- a/net/ceph/ceph_common.c
> +++ b/net/ceph/ceph_common.c
> @@ -788,7 +788,7 @@ EXPORT_SYMBOL(ceph_reset_client_addr);
>  /*
>   * mount: join the ceph cluster, and open root directory.
>   */
> -int __ceph_open_session(struct ceph_client *client, unsigned long started)
> +int __ceph_open_session(struct ceph_client *client)
>  {
>  	DEFINE_WAIT_FUNC(wait, woken_wake_function);
>  	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
> @@ -844,12 +844,11 @@ EXPORT_SYMBOL(__ceph_open_session);
>  int ceph_open_session(struct ceph_client *client)
>  {
>  	int ret;
> -	unsigned long started = jiffies;  /* note the start time */
>  
>  	dout("open_session start\n");
>  	mutex_lock(&client->mount_mutex);
>  
> -	ret = __ceph_open_session(client, started);
> +	ret = __ceph_open_session(client);
>  
>  	mutex_unlock(&client->mount_mutex);
>  	return ret;

Looks good.

Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

Thanks,
Slava.