mon: paxos: Delete logger in destructor

reset() can race with shutdown() leading to a use-after-free on the
'logger' object.

Fixes: https://tracker.ceph.com/issues/48386
Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
(cherry picked from commit cc295d1c87552eb76b9188d88d7e6ab2f3108149)

Conflicts:
	src/mon/Paxos.h
- stable branch has slightly different Paxos and get_name function declarations

diff --git a/src/mon/Paxos.cc b/src/mon/Paxos.cc
index a6bf59b853fc59d5f3a7d69db67e285c1ca839b1..180c80fb83d7798644e336cfd516290135ffcea8 100644 (file)
--- a/src/mon/Paxos.cc
+++ b/src/mon/Paxos.cc
@@ -1336,7 +1336,6 @@ void Paxos::shutdown()
   finish_contexts(g_ceph_context, committing_finishers, -ECANCELED);
   if (logger)
     g_ceph_context->get_perfcounters_collection()->remove(logger);
-  delete logger;
 }
 
 void Paxos::leader_init()

diff --git a/src/mon/Paxos.h b/src/mon/Paxos.h
index 4aed2fae77f058fe0d687d95ac236b236e22310f..4154ace07cbe7207024535e2a69c0d2be6ea78bb 100644 (file)
--- a/src/mon/Paxos.h
+++ b/src/mon/Paxos.h
@@ -1045,7 +1045,7 @@ public:
    * @param name A name for the paxos service. It serves as the naming space
    * of the underlying persistent storage for this service.
    */
-  Paxos(Monitor *m, const string &name) 
+  Paxos(Monitor *m, const string &name)
                 : mon(m),
                   logger(NULL),
                   paxos_name(name),
@@ -1065,6 +1065,10 @@ public:
                   clock_drift_warned(0),
                   trimming(false) { }
 
+  ~Paxos() {
+    delete logger;
+  }
+
   const string get_name() const {
     return paxos_name;
   }