]> git.apps.os.sepia.ceph.com Git - ceph.git/commit
projects / ceph.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: aefbe28) | patch
osd/ReplicatedBackend: fix use-after-free on InProgressOp 22133/head
authorSage Weil <sage@redhat.com>
Mon, 21 May 2018 21:39:47 +0000 (16:39 -0500)
committerSage Weil <sage@redhat.com>
Thu, 24 May 2018 18:08:31 +0000 (13:08 -0500)
commite84c2d097440aea5980fba2a2ef065769dbf1271
treee4d67ac6b6a958d17835c264e6e0a94da6e68dfetree | snapshot
parentaefbe28ae36c9524d7a42d71b2ee99de980a5a65commit | diff
osd/ReplicatedBackend: fix use-after-free on InProgressOp

- op in flight to disk...
- on_change() clears the InProgressOp
- C_OSD_OnOpCommit calls op_commit() w/ bare pointer
- crash!

Fix by refcounting InProgressOp and clearing on_commit when it is
canceled.

Fixes: http://tracker.ceph.com/issues/24219
Signed-off-by: Sage Weil <sage@redhat.com>
src/osd/ReplicatedBackend.cc diff | blob | history
src/osd/ReplicatedBackend.h diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.