mon: paxos: Delete logger in destructor

reset() can race with shutdown() leading to a use-after-free on the
'logger' object.

Fixes: https://tracker.ceph.com/issues/48386
Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
(cherry picked from commit cc295d1c87552eb76b9188d88d7e6ab2f3108149)

Conflicts:
	src/mon/Paxos.h
- stable branch has slightly different Paxos and get_name function declarations

diff --git a/src/mon/Paxos.cc b/src/mon/Paxos.cc
index 3a691931c9f2a2bc33f56144072671efa21af2cc..a62b028b57fe8f33ead105a9aa82e77704df4b19 100644 (file)
--- a/src/mon/Paxos.cc
+++ b/src/mon/Paxos.cc
@@ -1332,7 +1332,6 @@ void Paxos::shutdown()
   finish_contexts(g_ceph_context, committing_finishers, -ECANCELED);
   if (logger)
     g_ceph_context->get_perfcounters_collection()->remove(logger);
-  delete logger;
 }
 
 void Paxos::leader_init()

diff --git a/src/mon/Paxos.h b/src/mon/Paxos.h
index 590279ed9cef07780ce9d1ac38528fd0445ebc3e..75bac47223f7378a98f6639f09fc0477b05932ec 100644 (file)
--- a/src/mon/Paxos.h
+++ b/src/mon/Paxos.h
@@ -1045,7 +1045,7 @@ public:
    * @param name A name for the paxos service. It serves as the naming space
    * of the underlying persistent storage for this service.
    */
-  Paxos(Monitor *m, const string &name) 
+  Paxos(Monitor *m, const string &name)
                 : mon(m),
                   logger(NULL),
                   paxos_name(name),
@@ -1065,6 +1065,10 @@ public:
                   clock_drift_warned(0),
                   trimming(false) { }
 
+  ~Paxos() {
+    delete logger;
+  }
+
   const string get_name() const {
     return paxos_name;
   }