tools/immutable_object_cache: don't leak in-flight replies on teardown

CacheSession::send() deleted the reply in the async_write completion
handler. On teardown asio drops the pending handler without running it,
leaking the reply. Delete it right after encoding into bl instead; bl
owns the payload, so the write is unaffected.

Fixes: https://tracker.ceph.com/issues/77552
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>

diff --git a/src/tools/immutable_object_cache/CacheSession.cc b/src/tools/immutable_object_cache/CacheSession.cc
index e6adaead161ff4dabe9819d631a274e15863ce00..52f955142d3c9e6e95b48b9fdeb6f92e692d306c 100644 (file)
--- a/src/tools/immutable_object_cache/CacheSession.cc
+++ b/src/tools/immutable_object_cache/CacheSession.cc
@@ -122,13 +122,15 @@ void CacheSession::send(ObjectCacheRequest* reply) {
   bufferlist bl;
   reply->encode();
   bl.append(reply->get_payload_bufferlist());
+  // bl owns the encoded payload; free reply here so it can't leak if the
+  // handler is dropped on teardown.
+  delete reply;
 
   boost::asio::async_write(m_dm_socket,
         boost::asio::buffer(bl.c_str(), bl.length()),
         boost::asio::transfer_exactly(bl.length()),
-        [this, bl, reply](const boost::system::error_code& err,
+        [this, bl](const boost::system::error_code& err,
           size_t bytes_transferred) {
-          delete reply;
           if (err || bytes_transferred != bl.length()) {
             fault(err);
             return;