]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
librbd: fix use-after-free in trash purge on image open error 69836/head
authorSun Yuechi <sunyuechi@iscas.ac.cn>
Tue, 30 Jun 2026 11:50:09 +0000 (19:50 +0800)
committerSun Yuechi <sunyuechi@iscas.ac.cn>
Tue, 30 Jun 2026 16:13:42 +0000 (00:13 +0800)
commitf18247e32b769088d7afb76a9116636bcfab9468
treec4258a47ce9dd9a6ba18a25b8ecfc2501613f535
parent5e9da92c17e4aabf40ca84a630b7e03aa0ecaba2
librbd: fix use-after-free in trash purge on image open error

When ImageState::open() fails with an error other than -ENOENT, it
asynchronously deletes the ImageCtx before returning. The trash purge
loop only skipped the -ENOENT case and fell through on every other
error, dereferencing the already-freed ictx in diff_iterate() and
state->close(). Add the missing continue so a failed open is skipped.

The fall-through dates back to 504f4e78, which split `if (r < 0)
continue` to log non-ENOENT errors but dropped the continue.

Fixes: https://tracker.ceph.com/issues/77836
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
src/librbd/api/Trash.cc