From: Sun Yuechi Date: Sun, 21 Jun 2026 08:42:54 +0000 (+0800) Subject: tools/immutable_object_cache: don't leak in-flight replies on teardown X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=2d85d9e15855e662a4235c38c683a533213be934;p=ceph.git tools/immutable_object_cache: don't leak in-flight replies on teardown CacheSession::send() deleted the reply in the async_write completion handler. On teardown asio drops the pending handler without running it, leaking the reply. Delete it right after encoding into bl instead; bl owns the payload, so the write is unaffected. Fixes: https://tracker.ceph.com/issues/77552 Signed-off-by: Sun Yuechi --- diff --git a/src/tools/immutable_object_cache/CacheSession.cc b/src/tools/immutable_object_cache/CacheSession.cc index e6adaead161..52f955142d3 100644 --- a/src/tools/immutable_object_cache/CacheSession.cc +++ b/src/tools/immutable_object_cache/CacheSession.cc @@ -122,13 +122,15 @@ void CacheSession::send(ObjectCacheRequest* reply) { bufferlist bl; reply->encode(); bl.append(reply->get_payload_bufferlist()); + // bl owns the encoded payload; free reply here so it can't leak if the + // handler is dropped on teardown. + delete reply; boost::asio::async_write(m_dm_socket, boost::asio::buffer(bl.c_str(), bl.length()), boost::asio::transfer_exactly(bl.length()), - [this, bl, reply](const boost::system::error_code& err, + [this, bl](const boost::system::error_code& err, size_t bytes_transferred) { - delete reply; if (err || bytes_transferred != bl.length()) { fault(err); return;