mon/PGMonitor: fix use-after-free in stats ack

The MonOpRequestRef owns one ref; we need to get() another so we
can pass it to send_reply.

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/mon/PGMonitor.cc b/src/mon/PGMonitor.cc
index bc3ea49629ddbc33310590700735990e989537ea..9c6eefcf35cb14c64b2313f09fca1f0b8dd309d6 100644 (file)
--- a/src/mon/PGMonitor.cc
+++ b/src/mon/PGMonitor.cc
@@ -847,6 +847,7 @@ void PGMonitor::_updated_stats(MonOpRequestRef op, MonOpRequestRef ack_op)
   op->mark_pgmon_event(__func__);
   ack_op->mark_pgmon_event(__func__);
   MPGStats *ack = static_cast<MPGStats*>(ack_op->get_req());
+  ack->get();  // MonOpRequestRef owns one ref; give the other to send_reply.
   dout(7) << "_updated_stats for "
           << op->get_req()->get_orig_source_inst() << dendl;
   mon->send_reply(op, ack);