]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
common: OpTracker doesn't visit TrackedOp when nref == 0. 22160/head
authorRadoslaw Zarzynski <rzarzyns@redhat.com>
Tue, 22 May 2018 13:50:44 +0000 (15:50 +0200)
committerSage Weil <sage@redhat.com>
Wed, 23 May 2018 01:22:08 +0000 (20:22 -0500)
commite3e14b4c5fb7b7dc7db72edf157e409cb3ada632
treed8f2bf2f27534706bffc11227bb17ef570d4ebe6
parent4177b565ddb44a95536c55a3eada02c702d86f68
common: OpTracker doesn't visit TrackedOp when nref == 0.

The patch fixes a race condition that happens between
`unregister_inflight_op` and `visit_ops_in_flight` of
`OpTracker`. When a callable passed to the former one
turns the plain reference it gets into `TrackedOpRef`,
an almost-to-terminate `TrackedOp` (with `nref == 0`)
can be resurrected (`nref++`). This will be reflected
in extra call to `unregister_inflight_op` for same op
leading to e.g. use-after-free. For more details see:
https://tracker.ceph.com/issues/24037#note-5.

The fix deals with the problem by ensuring there will
be no call to the visitor for ops with zeroized `nref`.

Fixes: http://tracker.ceph.com/issues/24037
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
(cherry picked from commit 574aeb8130926fab5632d9f7a6ac0b132c6a60b8)
src/common/TrackedOp.cc