test/rbd_mirror: clear Namespace::s_instance at the end of a test

TestMockPoolReplayer.Namespaces and NamespacesError tests leave behind
a dangling pointer to a stack-allocated MockNamespace which leads to an
easily reproducible use-after-free and segfault when tests are shuffled.

Fixes: https://tracker.ceph.com/issues/70041
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/src/test/rbd_mirror/test_mock_PoolReplayer.cc b/src/test/rbd_mirror/test_mock_PoolReplayer.cc
index ec5d40f8705d30a634d015163912d0ae5f82bc53..31540021eb5a4d253b30d22de3343a48144a2d19 100644 (file)
--- a/src/test/rbd_mirror/test_mock_PoolReplayer.cc
+++ b/src/test/rbd_mirror/test_mock_PoolReplayer.cc
@@ -56,9 +56,15 @@ public:
   }
 
   Namespace() {
+    ceph_assert(s_instance == nullptr);
     s_instance = this;
   }
 
+  ~Namespace() {
+    ceph_assert(s_instance == this);
+    s_instance = nullptr;
+  }
+
   void add(const std::string &name) {
     std::lock_guard locker{m_lock};