client: Fix inode remove from snaprealm race

This is a follow on fix to b5ce4d0.  Always remove the inode from the
snaprealm's list of inodes_with_caps before the snaprealm ref is
decremented (and the snaprealm potentially gets freed).

Fixes #4694.
Signed-off-by: Sam Lang <sam.lang@inktank.com>
Reviewed-by: Greg Farnum <greg@inktank.com>

diff --git a/src/client/Client.cc b/src/client/Client.cc
index aae22ffa980dbf319223b14b72d834bb303d31c7..3bc8c5bfa9a038939b6bc7ca3512fdd08316e3a5 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -1948,9 +1948,9 @@ void Client::send_reconnect(MetaSession *session)
       in->exporting_mseq = 0;
       if (!in->is_any_caps()) {
        ldout(cct, 10) << "  removing last cap, closing snaprealm" << dendl;
+       in->snaprealm_item.remove_myself();
        put_snap_realm(in->snaprealm);
        in->snaprealm = 0;
-       in->snaprealm_item.remove_myself();
       }
     }
   }
@@ -3257,8 +3257,8 @@ void Client::handle_snap(MClientSnap *m)
        // queue for snap writeback
        queue_cap_snap(in, in->snaprealm->get_snap_context().seq);
 
-       put_snap_realm(in->snaprealm);
        in->snaprealm_item.remove_myself();
+       put_snap_realm(in->snaprealm);
        to_move.push_back(in);
       }
     }