]> git.apps.os.sepia.ceph.com Git - ceph-ci.git/commit
client: fix memory leak in Client::CRF_iofinish::complete
authorShachar Sharon <ssharon@redhat.com>
Tue, 22 Oct 2024 12:06:54 +0000 (15:06 +0300)
committerVenky Shankar <vshankar@redhat.com>
Mon, 23 Jun 2025 03:36:20 +0000 (09:06 +0530)
commitbd98ba47eb59e4d3bffafdd7f509890a2bd850d8
treed631a06cea0d4b082a4adaeba5e4788c5ca4c1e2
parenta4fd6422c851bea3dbb7d67e97c52200057fb559
client: fix memory leak in Client::CRF_iofinish::complete

Commit 1210ddf7a ("Client: Add non-blocking helper classes") introduced
Client::C_Read_Finisher Context object for async READ operations, but
it has a read-after-free bug which may cause memory leak when calling
libcephf's non-blocking ceph_ll_nonblocking_readv_writev API with async
READ:

ceph_ll_nonblocking_readv_writev (READ)
  Client::ll_preadv_pwritev
  ...
    Client::_read_async
      Context::complete
        Client::CRF_iofinish::complete
          Client::CRF_iofinish::finish
          CRF->finish_io()
            Client::C_Read_Finisher::finish_io
            ...
            delete this; // frees CRF_iofinish->CRF
          if (CRF->iofinished) // use-after-free of CRF
            delete this; // may not get here

A possible memory leak depends on timing and race with other thread
allocation which alters the memory address of CRF->iofinished to
false, thus skipping the last delete operation.

The check of `if (CRF->iofinished)` is unnecessary: it is always set to
true upon calling CRF->finish_io(). Thus, there is no need to have the
override function Client::CRF_iofinish::complete() as it now has the
same logic as Context::complete(). Removed.

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
(cherry picked from commit 6dc77563d4dac8c7e2f41dae445acba7694fa192)
src/client/Client.h