librbd: object copy state machine might dereference a deleted object

Fixes: http://tracker.ceph.com/issues/36220
Signed-off-by: Jason Dillaman <dillaman@redhat.com>
(cherry picked from commit 1a9c3be2ceffcb981910de429a7da0fbec43e643)

diff --git a/src/librbd/deep_copy/ObjectCopyRequest.cc b/src/librbd/deep_copy/ObjectCopyRequest.cc
index a935272286955e0c00060e09f9b82aed7e6e3048..7f10de32ff87f33103a7c901e9d06d9959bfc6d2 100644 (file)
--- a/src/librbd/deep_copy/ObjectCopyRequest.cc
+++ b/src/librbd/deep_copy/ObjectCopyRequest.cc
@@ -462,13 +462,16 @@ void ObjectCopyRequest<I>::send_update_object_map() {
       finish_op_ctx->complete(0);
     });
 
-  m_dst_image_ctx->object_map_lock.get_write();
-  bool sent = m_dst_image_ctx->object_map->template aio_update<
+  auto dst_image_ctx = m_dst_image_ctx;
+  dst_image_ctx->object_map_lock.get_write();
+  bool sent = dst_image_ctx->object_map->template aio_update<
     Context, &Context::complete>(dst_snap_id, m_dst_object_number, object_state,
                                  {}, {}, false, ctx);
-  m_dst_image_ctx->object_map_lock.put_write();
-  m_dst_image_ctx->snap_lock.put_read();
-  m_dst_image_ctx->owner_lock.put_read();
+
+  // NOTE: state machine might complete before we reach here
+  dst_image_ctx->object_map_lock.put_write();
+  dst_image_ctx->snap_lock.put_read();
+  dst_image_ctx->owner_lock.put_read();
   if (!sent) {
     assert(dst_snap_id == CEPH_NOSNAP);
     ctx->complete(0);