osdc/Objecter: cancel timeout before clearing op->session

The C_CancelOp path assumes op->session != NULL.  Cancel that op before
we clear it.  This fixes a crash like

#0  pthread_rwlock_wrlock () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_rwlock_wrlock.S:39
#1  0x00007fc82690a4b1 in RWLock::get_write (this=0x18, lockdep=<optimized out>) at ./common/RWLock.h:88
#2  0x00007fc8268f4d79 in Objecter::op_cancel (this=0x1f61830, s=0x0, tid=0, r=-110) at osdc/Objecter.cc:1850
#3  0x00007fc8268ba449 in Context::complete (this=0x1f68c20, r=<optimized out>) at ./include/Context.h:64
#4  0x00007fc8269769aa in RWTimer::timer_thread (this=0x1f61950) at common/Timer.cc:268
#5  0x00007fc82697a85d in RWTimerThread::entry (this=<optimized out>) at common/Timer.cc:200
#6  0x00007fc82651ce9a in start_thread (arg=0x7fc7e3fff700) at pthread_create.c:308

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/osdc/Objecter.cc b/src/osdc/Objecter.cc
index 952b2dc492989da8ebb8e802190f4dedeade9896..22a5f10359af1a533e4a36fe2cf01c592f4f9e27 100644 (file)
--- a/src/osdc/Objecter.cc
+++ b/src/osdc/Objecter.cc
@@ -2290,16 +2290,16 @@ void Objecter::_finish_op(Op *op)
   if (op->budgeted)
     put_op_budget(op);
 
+  if (op->ontimeout) {
+    timer.cancel_event(op->ontimeout);
+  }
+
   _session_op_remove(op->session, op);
 
   logger->dec(l_osdc_op_active);
 
   assert(check_latest_map_ops.find(op->tid) == check_latest_map_ops.end());
 
-  if (op->ontimeout) {
-    timer.cancel_event(op->ontimeout);
-  }
-
   inflight_ops.dec();
 
   op->put();