rbd: fix crash during map

Currently the iterator isn't advanced after the erase call leading to a
second call on the iterator, which crashes due to a double free.
Since C++11 the map::erase function returns an iterator pointing to the
next element. Use the return value to set the iterator after erasing.

Fixes: http://tracker.ceph.com/issues/21808
Signed-off-by: Peter Keresztes Schmidt <carbenium@outlook.com>

diff --git a/src/tools/rbd/action/Kernel.cc b/src/tools/rbd/action/Kernel.cc
index a0ffca60f416096fd592a1e2c13493a2d026c51b..e77dc6b18194e442e2a7ac48281150f920a0da0f 100644 (file)
--- a/src/tools/rbd/action/Kernel.cc
+++ b/src/tools/rbd/action/Kernel.cc
@@ -303,7 +303,7 @@ static int do_kernel_map(const char *poolname, const char *imgname,
     // default and omit it even if it was specified by the user
     // (see ceph.git commit fb0f1986449b)
     if (it->first == "rw" && it->second == "rw") {
-      map_options.erase(it);
+      it = map_options.erase(it);
     } else {
       if (it != map_options.begin())
         oss << ",";