librbd: fix use-after-free in trash purge on image open error

When ImageState::open() fails with an error other than -ENOENT, it
asynchronously deletes the ImageCtx before returning. The trash purge
loop only skipped the -ENOENT case and fell through on every other
error, dereferencing the already-freed ictx in diff_iterate() and
state->close(). Add the missing continue so a failed open is skipped.

The fall-through dates back to 504f4e78, which split `if (r < 0)
continue` to log non-ENOENT errors but dropped the continue.

Fixes: https://tracker.ceph.com/issues/77836
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>

diff --git a/src/librbd/api/Trash.cc b/src/librbd/api/Trash.cc
index aff6ff1c943122f281ef3174de1a554f8d3cd1ae..a135a004abcad26225c3328b2ae07179623579ff 100644 (file)
--- a/src/librbd/api/Trash.cc
+++ b/src/librbd/api/Trash.cc
@@ -487,6 +487,7 @@ int Trash<I>::purge(IoCtx& io_ctx, time_t expire_ts,
           } else if (r < 0) {
             lderr(cct) << "failed to open image " << it << ": "
                        << cpp_strerror(r) << dendl;
+            continue;
           }
 
           r = librbd::api::DiffIterate<I>::diff_iterate(