objectcacher: fix use-after-free

Move waiter check above close_object(ob) call.

diff --git a/src/osdc/ObjectCacher.cc b/src/osdc/ObjectCacher.cc
index 2b66d45cd880712cae519f05d2f42746fc7cd6d9..7ccc9c0a3a9ccd80e5c97ef663c10a7bf49f5794 100644 (file)
--- a/src/osdc/ObjectCacher.cc
+++ b/src/osdc/ObjectCacher.cc
@@ -572,6 +572,12 @@ void ObjectCacher::lock_ack(list<sobject_t>& oids, tid_t tid)
     Object *ob = objects[oid];
 
     list<Context*> ls;
+
+    // waiters?
+    if (ob->waitfor_ack.count(tid)) {
+      ls.splice(ls.end(), ob->waitfor_ack[tid]);
+      ob->waitfor_ack.erase(tid);
+    }
     
     assert(tid <= ob->last_write_tid);
     if (ob->last_write_tid == tid) {
@@ -608,12 +614,6 @@ void ObjectCacher::lock_ack(list<sobject_t>& oids, tid_t tid)
                << " tid " << tid << " obsolete" << dendl;
     }
 
-    // waiters?
-    if (ob->waitfor_ack.count(tid)) {
-      ls.splice(ls.end(), ob->waitfor_ack[tid]);
-      ob->waitfor_ack.erase(tid);
-    }
-
     finish_contexts(ls);
 
   }