]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
crimson/mon/MonClient: fix use-after-free in run_command 69862/head
authorSun Yuechi <sunyuechi@iscas.ac.cn>
Tue, 30 Jun 2026 12:06:53 +0000 (05:06 -0700)
committerSun Yuechi <sunyuechi@iscas.ac.cn>
Wed, 1 Jul 2026 11:13:32 +0000 (19:13 +0800)
commit11c48eb54708a0b4f833ecd308185aba180104cf
tree67cb37f8e396fa548aed2aaf2db542fb7b6562eb
parentd821b2814f71d75d48918790dd19f56175241344
crimson/mon/MonClient: fix use-after-free in run_command

run_command() captured a reference to the just-emplaced mon_commands
element into the send_message() continuation. mon_commands is a
std::vector, so a concurrent run_command() could reallocate it and
invalidate the reference before the continuation ran, dereferencing
freed memory.

No caller issues concurrent commands today, but the pattern is unsafe.

Take the result future before issuing the message, then coroutinize
the method so it is awaited directly instead of being captured into a
continuation lambda.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
src/crimson/mon/MonClient.cc