In mdc_create(), after a successful reint for a directory, two error exits return before *request = req:
 
  - req_capsule_server_get(&RMF_MDT_BODY) returns NULL → RETURN(-EPROTO)
  - req_capsule_server_sized_get(&RMF_MDT_MD) returns NULL → RETURN(-EPROTO)
 
The caller never gets the request, so it is never put. The request leaks, and with it the import reference taken by ptlrpc_request_alloc(). A short or malformed mkdir reply from the MDT can trigger either one.
 
Fix: ptlrpc_req_put(req) before both returns, or set *request = req first so the caller drops it.
  
Found during review of https://review.whamcloud.com/65026 (LU-20050)