mds: fix req use-after-free to get connection to direct reply

diff --git a/src/mds/MDCache.h b/src/mds/MDCache.h
index fc5897c2c50ef8c1f0bfbc433016e20e4d50a696..ae4d7f39d9cc78169878961665007ef10a890e66 100644 (file)
--- a/src/mds/MDCache.h
+++ b/src/mds/MDCache.h
@@ -366,8 +366,10 @@ struct MDRequest : public Mutation {
     in[0] = in[1] = 0; 
   }
   ~MDRequest() {
-    if(client_request) client_request->put();
-    if(slave_request) slave_request->put();
+    if (client_request)
+      client_request->put();
+    if (slave_request)
+      slave_request->put();
     delete _more;
   }
 

diff --git a/src/mds/Server.cc b/src/mds/Server.cc
index f26e8953281a599ffe095bc55d68a5e5a9048675..bde9d236e12a32a8e68c76fa240ccf51d550a9b6 100644 (file)
--- a/src/mds/Server.cc
+++ b/src/mds/Server.cc
@@ -857,10 +857,15 @@ void Server::reply_request(MDRequest *mdr, MClientReply *reply, CInode *tracei,
       mdr->cap_releases.erase(tracedn->get_dir()->get_inode()->vino());
   }
 
+  // note client connection to direct my reply
+  Connection *client_con = req->get_connection();
+  client_con->get();
+
   // clean up request, drop locks, etc.
   // do this before replying, so that we can issue leases
   mdcache->request_finish(mdr);
   mdr = 0;
+  req = 0;
 
   // reply at all?
   if (client_inst.name.is_mds()) {
@@ -880,8 +885,9 @@ void Server::reply_request(MDRequest *mdr, MClientReply *reply, CInode *tracei,
     }
 
     reply->set_mdsmap_epoch(mds->mdsmap->get_epoch());
-    messenger->send_message(reply, req->get_connection());
+    messenger->send_message(reply, client_con);
   }
+  client_con->put();
   
   // take a closer look at tracei, if it happens to be a remote link
   if (tracei &&