]> git.apps.os.sepia.ceph.com Git - ceph.git/commit
client: fix memory leak in Client::CRF_iofinish::complete 60507/head
authorShachar Sharon <ssharon@redhat.com>
Tue, 22 Oct 2024 12:06:54 +0000 (15:06 +0300)
committerShachar Sharon <ssharon@redhat.com>
Fri, 13 Jun 2025 11:33:30 +0000 (14:33 +0300)
commit6dc77563d4dac8c7e2f41dae445acba7694fa192
tree36d031b9b9693b7392eeac75aaad6bf9c7877303
parentd28e5fe890016235e302122f955fc910c96f2d43
client: fix memory leak in Client::CRF_iofinish::complete

Commit 1210ddf7a ("Client: Add non-blocking helper classes") introduced
Client::C_Read_Finisher Context object for async READ operations, but
it has a read-after-free bug which may cause memory leak when calling
libcephf's non-blocking ceph_ll_nonblocking_readv_writev API with async
READ:

ceph_ll_nonblocking_readv_writev (READ)
  Client::ll_preadv_pwritev
  ...
    Client::_read_async
      Context::complete
        Client::CRF_iofinish::complete
          Client::CRF_iofinish::finish
          CRF->finish_io()
            Client::C_Read_Finisher::finish_io
            ...
            delete this; // frees CRF_iofinish->CRF
          if (CRF->iofinished) // use-after-free of CRF
            delete this; // may not get here

A possible memory leak depends on timing and race with other thread
allocation which alters the memory address of CRF->iofinished to
false, thus skipping the last delete operation.

The check of `if (CRF->iofinished)` is unnecessary: it is always set to
true upon calling CRF->finish_io(). Thus, there is no need to have the
override function Client::CRF_iofinish::complete() as it now has the
same logic as Context::complete(). Removed.

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
src/client/Client.h