]> git.apps.os.sepia.ceph.com Git - ceph-ci.git/commit
client: fix memory leak in Client::CRF_iofinish::complete
authorShachar Sharon <ssharon@redhat.com>
Tue, 22 Oct 2024 12:06:54 +0000 (15:06 +0300)
committerVenky Shankar <vshankar@redhat.com>
Mon, 23 Jun 2025 03:19:03 +0000 (03:19 +0000)
commitb3578ab42b4341f986564a6e55e5de39f0b84ccf
treeb42f39be44b49059c493ae1b3dacc682da15ecca
parente01243e99c03d93e9e1597bce8d11d806a4cdfab
client: fix memory leak in Client::CRF_iofinish::complete

Commit 1210ddf7a ("Client: Add non-blocking helper classes") introduced
Client::C_Read_Finisher Context object for async READ operations, but
it has a read-after-free bug which may cause memory leak when calling
libcephf's non-blocking ceph_ll_nonblocking_readv_writev API with async
READ:

ceph_ll_nonblocking_readv_writev (READ)
  Client::ll_preadv_pwritev
  ...
    Client::_read_async
      Context::complete
        Client::CRF_iofinish::complete
          Client::CRF_iofinish::finish
          CRF->finish_io()
            Client::C_Read_Finisher::finish_io
            ...
            delete this; // frees CRF_iofinish->CRF
          if (CRF->iofinished) // use-after-free of CRF
            delete this; // may not get here

A possible memory leak depends on timing and race with other thread
allocation which alters the memory address of CRF->iofinished to
false, thus skipping the last delete operation.

The check of `if (CRF->iofinished)` is unnecessary: it is always set to
true upon calling CRF->finish_io(). Thus, there is no need to have the
override function Client::CRF_iofinish::complete() as it now has the
same logic as Context::complete(). Removed.

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
(cherry picked from commit 6dc77563d4dac8c7e2f41dae445acba7694fa192)
src/client/Client.h