From: Sage Weil <sage@redhat.com>
Date: Mon, 14 Sep 2015 01:48:47 +0000 (-0400)
Subject: mon/PGMonitor: fix use-after-free in stats ack
X-Git-Tag: v9.1.0~135^2~1^2~8
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=640ebbfa3ad6f8dade0187588645f36f154625bf;p=ceph.git

mon/PGMonitor: fix use-after-free in stats ack

The MonOpRequestRef owns one ref; we need to get() another so we
can pass it to send_reply.

Signed-off-by: Sage Weil <sage@redhat.com>
---

diff --git a/src/mon/PGMonitor.cc b/src/mon/PGMonitor.cc
index bc3ea49629dd..9c6eefcf35cb 100644
--- a/src/mon/PGMonitor.cc
+++ b/src/mon/PGMonitor.cc
@@ -847,6 +847,7 @@ void PGMonitor::_updated_stats(MonOpRequestRef op, MonOpRequestRef ack_op)
   op->mark_pgmon_event(__func__);
   ack_op->mark_pgmon_event(__func__);
   MPGStats *ack = static_cast<MPGStats*>(ack_op->get_req());
+  ack->get();  // MonOpRequestRef owns one ref; give the other to send_reply.
   dout(7) << "_updated_stats for "
           << op->get_req()->get_orig_source_inst() << dendl;
   mon->send_reply(op, ack);