]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
librbd/migration/QCOWFormat: avoid use-after-free in execute_request() 67919/head
authorIlya Dryomov <idryomov@gmail.com>
Wed, 11 Mar 2026 11:04:24 +0000 (12:04 +0100)
committerIlya Dryomov <idryomov@gmail.com>
Fri, 20 Mar 2026 15:28:05 +0000 (16:28 +0100)
commitef93632ae44fb2c458f3f59244ca01300b9190d0
treea1c0f94a8d22553528e5568cbe86e3c4d6b6b4cf
parentfa72934c91bd660d36bf6b4e604b5fb0987daa45
librbd/migration/QCOWFormat: avoid use-after-free in execute_request()

Both L2TableCache and QCOWFormat can be destroyed after the completion
for the last L2 cache request is posted, particularly so in unit tests.
The strand destructor doesn't drain the handler queue in any way but
merely ensures that previously posted handlers would get dispatched in
a non-concurrent fashion.  As a result, use-after-free can ensue when
execute_request() unnecessarily dispatches itself for the last time.

Fixes: https://tracker.ceph.com/issues/75378
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
src/librbd/migration/QCOWFormat.cc