From: Jason Dillaman <dillaman@redhat.com>
Date: Tue, 28 Jul 2020 13:07:49 +0000 (-0400)
Subject: librbd: ensure image cannot be closed until in-flight IO callbacks complete
X-Git-Tag: v15.2.5~61^2~1
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=21347122003f4463a91f5c29b7a0d2e3b9d91256;p=ceph.git

librbd: ensure image cannot be closed until in-flight IO callbacks complete

If a librbd client attempts to close the image while it still has in-flight IO
pending, it's possible for the AsyncOperation tracker which prevents the image
from being closed to be completed before the actual AioCompletion callback
fires. This can result in the now destructed ImageCtx being de-referenced by
the AioCompletion.

Fixes: https://tracker.ceph.com/issues/46737
Signed-off-by: Jason Dillaman <dillaman@redhat.com>
(cherry picked from commit 0d64e31c191f04b10b5318eb6d4db9dd83b2d166)

Conflicts:
	src/librbd/io/AioCompletion.cc: trivial resolution
---

diff --git a/src/librbd/io/AioCompletion.cc b/src/librbd/io/AioCompletion.cc
index 2ddefdaccb96..fa0548f15573 100644
--- a/src/librbd/io/AioCompletion.cc
+++ b/src/librbd/io/AioCompletion.cc
@@ -112,10 +112,6 @@ void AioCompletion::complete() {
     notify_callbacks_complete();
   }
 
-  // note: possible for image to be closed after op marked finished
-  if (async_op.started()) {
-    async_op.finish_op();
-  }
   tracepoint(librbd, aio_complete_exit);
 }
 
@@ -278,8 +274,15 @@ void AioCompletion::complete_event_socket() {
 void AioCompletion::notify_callbacks_complete() {
   state = AIO_STATE_COMPLETE;
 
-  std::unique_lock<std::mutex> locker(lock);
-  cond.notify_all();
+  {
+    std::unique_lock<std::mutex> locker(lock);
+    cond.notify_all();
+  }
+
+  // note: possible for image to be closed after op marked finished
+  if (async_op.started()) {
+    async_op.finish_op();
+  }
 }
 
 } // namespace io