From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 12 May 2026 09:55:06 +0000 (+0800)
Subject: crimson/osd: inline log file stream setup to fix dangling pointer
X-Git-Tag: v21.0.1~159^2~2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=3308b63c29ccbccf64285332092e636813230a2f;p=ceph.git

crimson/osd: inline log file stream setup to fix dangling pointer

maybe_set_logger() called logger().set_ostream() with a reference to a
local ofstream before returning it by value. Correctness relied on NRVO:
without it, _out would point to a moved-from object on a dead stack frame,
causing undefined behaviour that manifests as a heap-buffer-overflow under
ASan with GCC 14 (libasan.so.8).

Note that seastar::logger::_out is a static member shared by all logger
instances, so the dangling pointer affects every logger (seastore, network,
OSD), explaining why the crash appears across subsystems.

Inline the setup so log_file_stream and reset_logger share the same scope.
set_ostream() is now called with an unambiguously live object, with no
dependence on copy elision.

Fixes: 66c923d70354415cd1746c4f57cf31f3d55cc1bd

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---

diff --git a/src/crimson/osd/main.cc b/src/crimson/osd/main.cc
index 174bdc2772a..c549277888d 100644
--- a/src/crimson/osd/main.cc
+++ b/src/crimson/osd/main.cc
@@ -74,20 +74,6 @@ seastar::future<> make_keyring()
   });
 }
 
-static std::ofstream maybe_set_logger()
-{
-  std::ofstream log_file_stream;
-  if (auto log_file = local_conf()->log_file; !log_file.empty()) {
-    log_file_stream.open(log_file, std::ios::app | std::ios::out);
-    try {
-      seastar::throw_system_error_on(log_file_stream.fail());
-    } catch (const std::system_error& e) {
-      ceph_abort_msg(fmt::format("unable to open log file: {}", e.what()));
-    }
-    logger().set_ostream(log_file_stream);
-  }
-  return log_file_stream;
-}
 
 int main(int argc, const char* argv[])
 {
@@ -171,7 +157,16 @@ int main(int argc, const char* argv[])
           local_conf().parse_argv(config_proxy_args).get();
 
           DEBUG("initializing logger output");
-          auto log_file_stream = maybe_set_logger();
+          std::ofstream log_file_stream;
+          if (auto log_file = local_conf()->log_file; !log_file.empty()) {
+            log_file_stream.open(log_file, std::ios::app | std::ios::out);
+            try {
+              seastar::throw_system_error_on(log_file_stream.fail());
+            } catch (const std::system_error& e) {
+              ceph_abort_msg(fmt::format("unable to open log file: {}", e.what()));
+            }
+            logger().set_ostream(log_file_stream);
+          }
           auto reset_logger = seastar::defer([] {
             logger().set_ostream(std::cerr);
           });