librbd: potential use after free on refresh error

Signed-off-by: Mykola Golub <mgolub@mirantis.com>
(cherry picked from commit e92b3950cd261d36de422ccaa4a2441d41c80d0c)

diff --git a/src/librbd/AioImageRequestWQ.cc b/src/librbd/AioImageRequestWQ.cc
index fba79339fb74012ecf6c98f07d3ad03eb557b033..22ad364273568a15584f367ce57bea3840660879 100644 (file)
--- a/src/librbd/AioImageRequestWQ.cc
+++ b/src/librbd/AioImageRequestWQ.cc
@@ -460,9 +460,8 @@ void AioImageRequestWQ::handle_refreshed(int r, AioImageRequest<> *req) {
                  << "req=" << req << dendl;
   if (r < 0) {
     req->fail(r);
-    delete req;
-
     finish_queued_op(req);
+    delete req;
     finish_in_flight_op();
   } else {
     // since IO was stalled for refresh -- original IO order is preserved