osd/PG: fix uninit read in Incomplete::react(AdvMap&)

If a PG is incomplete when the pool is deleted we'll dereference invalid
iterators here.

Fixes: http://tracker.ceph.com/issues/23980
Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 3187b036d83adae3646d411e6705e056189f33bb)

diff --git a/src/osd/PG.cc b/src/osd/PG.cc
index 1558c901a02c6d8672dc5ad956b8ab2bdb74b953..60841dda5534433e3a58555f9ec680b2a61842ce 100644 (file)
--- a/src/osd/PG.cc
+++ b/src/osd/PG.cc
@@ -8192,7 +8192,8 @@ boost::statechart::result PG::RecoveryState::Incomplete::react(const AdvMap &adv
   int64_t poolnum = pg->info.pgid.pool();
 
   // Reset if min_size turn smaller than previous value, pg might now be able to go active
-  if (advmap.lastmap->get_pools().find(poolnum)->second.min_size >
+  if (!advmap.osdmap->have_pg_pool(poolnum) ||
+      advmap.lastmap->get_pools().find(poolnum)->second.min_size >
       advmap.osdmap->get_pools().find(poolnum)->second.min_size) {
     post_event(advmap);
     return transit< Reset >();