mon: paxos: Delete logger in destructor

reset() can race with shutdown() leading to a use-after-free on the
'logger' object.

Fixes: https://tracker.ceph.com/issues/48386
Signed-off-by: Brad Hubbard <bhubbard@redhat.com>

diff --git a/src/mon/Paxos.cc b/src/mon/Paxos.cc
index 7f64bf7446a05d250618ad70884d097cc8e5d81a..39f9045839ae91933907390decf415e8be9cfe9f 100644 (file)
--- a/src/mon/Paxos.cc
+++ b/src/mon/Paxos.cc
@@ -1343,7 +1343,6 @@ void Paxos::shutdown()
   finish_contexts(g_ceph_context, committing_finishers, -ECANCELED);
   if (logger)
     g_ceph_context->get_perfcounters_collection()->remove(logger);
-  delete logger;
 }
 
 void Paxos::leader_init()

diff --git a/src/mon/Paxos.h b/src/mon/Paxos.h
index 56ef403631f6259d2d8b64b9d0d28e6d20f1b883..657b646e2c3bf6694c077ed3fb078936d06ac782 100644 (file)
--- a/src/mon/Paxos.h
+++ b/src/mon/Paxos.h
@@ -1045,7 +1045,7 @@ public:
    * @param name A name for the paxos service. It serves as the naming space
    * of the underlying persistent storage for this service.
    */
-  Paxos(Monitor *m, const std::string &name) 
+  Paxos(Monitor *m, const std::string &name)
                 : mon(m),
                   logger(NULL),
                   paxos_name(name),
@@ -1065,6 +1065,10 @@ public:
                   clock_drift_warned(0),
                   trimming(false) { }
 
+  ~Paxos() {
+    delete logger;
+  }
+
   const std::string get_name() const {
     return paxos_name;
   }