librados: aio watch/unwatch/notify now uses completion objver

A local variable was used for an async callback operation,
resulting in the potential for memory corruption.

Signed-off-by: Jason Dillaman <dillaman@redhat.com>

diff --git a/src/librados/IoCtxImpl.cc b/src/librados/IoCtxImpl.cc
index f5f47b4447537e88a2211880e77718941225206a..effa1a35650daa62948ee96a5be2e976e6b14d34 100644 (file)
--- a/src/librados/IoCtxImpl.cc
+++ b/src/librados/IoCtxImpl.cc
@@ -1307,8 +1307,6 @@ int librados::IoCtxImpl::aio_watch(const object_t& oid,
   Context *oncomplete = new C_aio_linger_Complete(c, linger_op, false);
 
   ::ObjectOperation wr;
-  version_t objver;
-
   *handle = linger_op->get_cookie();
   linger_op->watch_context = new WatchInfo(this, oid, ctx, ctx2);
 
@@ -1317,7 +1315,7 @@ int librados::IoCtxImpl::aio_watch(const object_t& oid,
   bufferlist bl;
   objecter->linger_watch(linger_op, wr,
                          snapc, ceph::real_clock::now(), bl,
-                         oncomplete, &objver);
+                         oncomplete, &c->objver);
 
   return 0;
 }
@@ -1366,14 +1364,13 @@ int librados::IoCtxImpl::aio_unwatch(uint64_t cookie, AioCompletionImpl *c)
   c->io = this;
   Objecter::LingerOp *linger_op = reinterpret_cast<Objecter::LingerOp*>(cookie);
   Context *oncomplete = new C_aio_linger_Complete(c, linger_op, true);
-  version_t ver = 0;
 
   ::ObjectOperation wr;
   prepare_assert_ops(&wr);
   wr.watch(cookie, CEPH_OSD_WATCH_OP_UNWATCH);
   objecter->mutate(linger_op->target.base_oid, oloc, wr,
                   snapc, ceph::real_clock::now(client->cct), 0, NULL,
-                  oncomplete, &ver);
+                  oncomplete, &c->objver);
   return 0;
 }
 
@@ -1457,7 +1454,7 @@ int librados::IoCtxImpl::aio_notify(const object_t& oid, AioCompletionImpl *c,
   // Issue RADOS op
   objecter->linger_notify(linger_op,
                          rd, snap_seq, inbl, NULL,
-                         onack, NULL);
+                         onack, &c->objver);
   return 0;
 }