objectcacher: fix use-after-free atomic_sync_readx

readx() releases rd; copy snapid so we can use it later.

diff --git a/src/osdc/ObjectCacher.cc b/src/osdc/ObjectCacher.cc
index 474d1c417cee5045f27de6ff9b02c2c7b2e46219..9f963d774e71fec65b92836bedd5ff2f9767acca 100644 (file)
--- a/src/osdc/ObjectCacher.cc
+++ b/src/osdc/ObjectCacher.cc
@@ -1134,6 +1134,7 @@ int ObjectCacher::atomic_sync_readx(OSDRead *rd, ObjectSet *oset, Mutex& lock)
     // do the read, into our cache
     Mutex flock("ObjectCacher::atomic_sync_readx flock 2");
     Cond cond;
+    snapid_t snapid = rd->snap;
     bool done = false;
     readx(rd, oset, new C_SafeCond(&flock, &cond, &done));
     
@@ -1144,7 +1145,7 @@ int ObjectCacher::atomic_sync_readx(OSDRead *rd, ObjectSet *oset, Mutex& lock)
     for (vector<ObjectExtent>::iterator ex_it = extents.begin();
          ex_it != extents.end();
          ex_it++) {
-      sobject_t soid(ex_it->oid, rd->snap);
+      sobject_t soid(ex_it->oid, snapid);
       assert(objects.count(soid));
       Object *o = objects[soid];
       rdunlock(o);