common/Timer: fixed invalid read from deleted object

The std::conditional_variable will keep the provided reference and
repeatedly dereference it even after the lock was dropped and
re-acquired. This can lead to an invalid read if the associated
schedule entry has been removed while waiting.

Signed-off-by: Jason Dillaman <dillaman@redhat.com>

diff --git a/src/common/Timer.cc b/src/common/Timer.cc
index 39ad4531915826f3b1831eb3f0ef8c0fecf8b7a4..bf050e6395a4d0459145141f8243321f67d2ed78 100644 (file)
--- a/src/common/Timer.cc
+++ b/src/common/Timer.cc
@@ -107,7 +107,8 @@ void SafeTimer::timer_thread()
     if (schedule.empty()) {
       cond.wait(l);
     } else {
-      cond.wait_until(l, schedule.begin()->first);
+      auto when = schedule.begin()->first;
+      cond.wait_until(l, when);
     }
     ldout(cct,20) << "timer_thread awake" << dendl;
   }