neorados: Go through linger_cancel on `io_context` shutdown

Rather than just dropping the reference, clean up the linger operation
properly within Objecter. Also, clear out handlers before
relinquishing reference to avoid use-after-free.

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>

diff --git a/src/neorados/RADOS.cc b/src/neorados/RADOS.cc
index 3824e3fe6c3dfc1d07bcaf1a7a74071d9dbe9531..79fb3d8a4778f354a548475da8731e663feda118 100644 (file)
--- a/src/neorados/RADOS.cc
+++ b/src/neorados/RADOS.cc
@@ -1397,11 +1397,16 @@ class Notifier : public async::service_list_base_hook {
     if (neoref) {
       neoref = nullptr;
     }
-    if (linger_op) {
-      linger_op->put();
-    }
     std::unique_lock l(m);
     handlers.clear();
+    l.unlock();
+    if (linger_op) {
+      // We are being taken down and will execute no more
+      // handlers. Call `linger_cancel` to clean up properly in
+      // Objecter. (It doesn't call out to the OSD or anything.)
+      linger_op->objecter->linger_cancel(linger_op);
+    }
+    // We may be freed after this point. Touch nothing.
   }
 
 public: