]> git.apps.os.sepia.ceph.com Git - ceph.git/commit
common: OpTracker doesn't visit TrackedOp when nref == 0. 22156/head
authorRadoslaw Zarzynski <rzarzyns@redhat.com>
Tue, 22 May 2018 13:50:44 +0000 (15:50 +0200)
committerRadoslaw Zarzynski <rzarzyns@redhat.com>
Tue, 22 May 2018 16:21:56 +0000 (18:21 +0200)
commit574aeb8130926fab5632d9f7a6ac0b132c6a60b8
tree634137b9a2df14a63bad300023ec05b60bf1c8b4
parentea205e1cbbe86661023ef50e5592225a751bec66
common: OpTracker doesn't visit TrackedOp when nref == 0.

The patch fixes a race condition that happens between
`unregister_inflight_op` and `visit_ops_in_flight` of
`OpTracker`. When a callable passed to the former one
turns the plain reference it gets into `TrackedOpRef`,
an almost-to-terminate `TrackedOp` (with `nref == 0`)
can be resurrected (`nref++`). This will be reflected
in extra call to `unregister_inflight_op` for same op
leading to e.g. use-after-free. For more details see:
https://tracker.ceph.com/issues/24037#note-5.

The fix deals with the problem by ensuring there will
be no call to the visitor for ops with zeroized `nref`.

Fixes: http://tracker.ceph.com/issues/24037
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
src/common/TrackedOp.cc