From: Jason Dillaman <dillaman@redhat.com>
Date: Sun, 5 Jul 2015 15:09:09 +0000 (-0400)
Subject: librbd: don't attempt to invalidate an object map in R/O mode
X-Git-Tag: v0.94.3~29^2~2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=4a77be0a65c8b4ec3dc437721f8c321737b260de;p=ceph.git

librbd: don't attempt to invalidate an object map in R/O mode

The ImageWatcher is not initialized when in R/O mode, which
resulted in a NULL pointer dereference.

Signed-off-by: Jason Dillaman <dillaman@redhat.com>
(cherry picked from commit 64d740f8fa10ba872e324ec2580a4d8c3f99a9ce)
---

diff --git a/src/librbd/ObjectMap.cc b/src/librbd/ObjectMap.cc
index 67ff1a20e30c..c2ca798b584f 100644
--- a/src/librbd/ObjectMap.cc
+++ b/src/librbd/ObjectMap.cc
@@ -274,6 +274,7 @@ void ObjectMap::aio_resize(uint64_t new_size, uint8_t default_object_state,
 			   Context *on_finish) {
   assert(m_image_ctx.test_features(RBD_FEATURE_OBJECT_MAP));
   assert(m_image_ctx.owner_lock.is_locked());
+  assert(m_image_ctx.image_watcher != NULL);
   assert(m_image_ctx.image_watcher->is_lock_owner());
 
   ResizeRequest *req = new ResizeRequest(
@@ -296,7 +297,9 @@ bool ObjectMap::aio_update(uint64_t start_object_no, uint64_t end_object_no,
 {
   assert(m_image_ctx.test_features(RBD_FEATURE_OBJECT_MAP));
   assert(m_image_ctx.owner_lock.is_locked());
+  assert(m_image_ctx.image_watcher != NULL);
   assert(m_image_ctx.image_watcher->is_lock_owner());
+  assert(start_object_no < end_object_no);
 
   RWLock::WLocker l(m_image_ctx.object_map_lock);
   assert(start_object_no < end_object_no);
@@ -339,8 +342,9 @@ void ObjectMap::invalidate() {
                            true);
 
   // do not update on-disk flags if not image owner
-  if (m_image_ctx.image_watcher->is_lock_supported(m_image_ctx.snap_lock) &&
-      !m_image_ctx.image_watcher->is_lock_owner()) {
+  if (m_image_ctx.image_watcher == NULL ||
+      (m_image_ctx.image_watcher->is_lock_supported(m_image_ctx.snap_lock) &&
+       !m_image_ctx.image_watcher->is_lock_owner())) {
     return;
   }