os/bluestore: avoid OpSequencer::parent

The parent may go away, so we need to keep our own copy of shard_hint in
OpSequencer to avoid a user-after-free (e.g., when the user drops their
osr and calls OpSequencer::discard()).

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 43b6089e3101c8af1c204120507c10647460c1ea..a7b10a42e69fd6b9d88af3b1995ecd103db3b037 100644 (file)
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -8216,7 +8216,7 @@ void BlueStore::_txc_applied_kv(TransContext *txc)
 void BlueStore::_txc_committed_kv(TransContext *txc)
 {
   dout(20) << __func__ << " txc " << txc << dendl;
-  unsigned n = txc->osr->parent->shard_hint.hash_to_shard(m_finisher_num);
+  unsigned n = txc->osr->shard_hint.hash_to_shard(m_finisher_num);
   logger->tinc(l_bluestore_commit_lat, ceph_clock_now() - txc->start);
   finishers[n]->queue(txc->oncommits);
 }
@@ -9013,6 +9013,7 @@ int BlueStore::queue_transactions(
   } else {
     osr = new OpSequencer(cct, this);
     osr->parent = posr;
+    osr->shard_hint = posr->shard_hint;
     posr->p = osr;
     dout(10) << __func__ << " new " << osr << " " << *osr << dendl;
   }
@@ -9076,7 +9077,7 @@ int BlueStore::queue_transactions(
   for (auto c : on_applied_sync) {
     c->complete(0);
   }
-  unsigned n = osr->parent->shard_hint.hash_to_shard(m_finisher_num);
+  unsigned n = osr->shard_hint.hash_to_shard(m_finisher_num);
   for (auto c : on_applied) {
     // NOTE: these may complete out of order since some may be sync and some
     // may be async.

diff --git a/src/os/bluestore/BlueStore.h b/src/os/bluestore/BlueStore.h
index 38e829814a076ada83d3e17b656691b1d282d08c..4b2793b60a3153e4503b193b12c50e43e32f7f41 100644 (file)
--- a/src/os/bluestore/BlueStore.h
+++ b/src/os/bluestore/BlueStore.h
@@ -1661,6 +1661,8 @@ public:
     Sequencer *parent;
     BlueStore *store;
 
+    spg_t shard_hint;
+
     uint64_t last_seq = 0;
 
     std::atomic_int txc_with_unstable_io = {0};  ///< num txcs with unstable io