Commit c3e64079d8b9 for kernel

commit c3e64079d8b9663e3998d0caac9aba915b6b93ae
Author: WenTao Liang <vulab@iscas.ac.cn>
Date:   Thu Jun 11 22:40:07 2026 +0800

    ceph: fix refcount leak in ceph_readdir()

    The ceph_readdir() function allocates a ceph_mds_request via
    ceph_mdsc_create_request() and stores it in dfi->last_readdir. In
    the directory entry processing loop, if the entry's offset is less
    than ctx->pos or if the inode pointer is unexpectedly NULL, the
    function returns -EIO without releasing the reference held by
    dfi->last_readdir, causing a refcount leak.

    Fix this by adding ceph_mdsc_put_request(dfi->last_readdir) before
    returning on these error paths. Also set dfi->last_readdir to NULL
    for safety, matching the cleanup done at the normal exit.

    Cc: stable@vger.kernel.org
    Fixes: af9ffa6df7e3 ("ceph: add support to readdir for encrypted names")
    Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
    Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
    Reviewed-by: Alex Markuze <amarkuze@redhat.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 27ce9e55e947..ef9e92e362d3 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -546,11 +546,16 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
 			pr_warn_client(cl,
 				"%p %llx.%llx rde->offset 0x%llx ctx->pos 0x%llx\n",
 				inode, ceph_vinop(inode), rde->offset, ctx->pos);
+			ceph_mdsc_put_request(dfi->last_readdir);
+			dfi->last_readdir = NULL;
 			return -EIO;
 		}

-		if (WARN_ON_ONCE(!rde->inode.in))
+		if (WARN_ON_ONCE(!rde->inode.in)) {
+			ceph_mdsc_put_request(dfi->last_readdir);
+			dfi->last_readdir = NULL;
 			return -EIO;
+		}

 		ctx->pos = rde->offset;
 		doutc(cl, "%p %llx.%llx (%d/%d) -> %llx '%.*s' %p\n", inode,