mds: fix use-after-free in snaprealm_create_finish

We pass mut's log segment to snapclient->commit().

diff --git a/src/mds/MDCache.cc b/src/mds/MDCache.cc
index f2c59a2e6770147e0e6e0cb7175217c06f670fcd..e5b61d8f5335a9247b471580ab0a355f17c151a1 100644 (file)
--- a/src/mds/MDCache.cc
+++ b/src/mds/MDCache.cc
@@ -6909,11 +6909,12 @@ void MDCache::_snaprealm_create_finish(MDRequest *mdr, Mutation *mut, CInode *in
   mut->apply();
   mds->locker->drop_locks(mut);
   mut->cleanup();
-  delete mut;
 
   // tell table we've committed
   mds->snapclient->commit(mdr->more()->stid, mut->ls);
 
+  delete mut;
+
   // create
   bufferlist::iterator p = mdr->more()->snapidbl.begin();
   snapid_t seq;