From: Matan Breizman <mbreizma@redhat.com>
Date: Tue, 20 Jan 2026 13:35:40 +0000 (+0000)
Subject: Revert "common/options: fix heap-use-after-free by using never-destroyed static"
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=77da5ac95b5b955cbfe7d3a104586294725a8055;p=ceph.git

Revert "common/options: fix heap-use-after-free by using never-destroyed static"

```
Jan 20 09:27:16 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]: AddressSanitizer:DEADLYSIGNAL
Jan 20 09:27:16 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]: =================================================================
Jan 20 09:27:16 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]: ==3==ERROR: AddressSanitizer: stack-overflow on address 0x7b512f6c8dd8 (pc 0x0000046e7a72 bp 0x7b512de7c900 sp 0x7b512f6c8dd8 T0)
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #0 0x0000046e7a72 in get_global_options() (/usr/bin/ceph-osd-crimson+0x46e7a72) (BuildId: 2a86043f51c9be9cb19801e276fb3ee36239556a)
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #1 0x0000046e540e in build_options() (/usr/bin/ceph-osd-crimson+0x46e540e) (BuildId: 2a86043f51c9be9cb19801e276fb3ee36239556a)
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #2 0x0000033b7949 in get_ceph_options() (/usr/bin/ceph-osd-crimson+0x33b7949) (BuildId: 2a86043f51c9be9cb19801e276fb3ee36239556a)
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #3 0x000003440540 in md_config_t::md_config_t(ConfigValues&, ConfigTracker const&, bool) (/usr/bin/ceph-osd-crimson+0x3440540) (BuildId: 2a860>
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #4 0x0000046856a8 in crimson::common::ConfigProxy::ConfigProxy(EntityName const&, std::basic_string_view<char, std::char_traits<char> >) (/usr>
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #5 0x000000eb6cb5 in seastar::shared_ptr_count_for<crimson::common::ConfigProxy>::shared_ptr_count_for<EntityName&, std::__cxx11::basic_string>
..
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #40 0x000000ed6434 in seastar::future<int> seastar::futurize<int>::apply<crimson::osd::_get_early_config(int, char const**)::{lambda()#1}::ope>
Jan 20 09:27:17 ceph-node-0 ceph-e818662e-f5e1-11f0-b263-525400908ba7-osd-1[12300]:     #41 0x000000ed672b in seastar::async<crimson::osd::_get_early_config(int, char const**)::{lambda()#1}::operator()() const::{lambda()#1}>(seast>
```

This reverts commit 1ab0a8cb726cb730954294423acec887b92fa5b0.

Fixes: https://tracker.ceph.com/issues/74481

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---

diff --git a/src/common/ceph_context.cc b/src/common/ceph_context.cc
index 5bb0b4678b763..afd22f865437e 100644
--- a/src/common/ceph_context.cc
+++ b/src/common/ceph_context.cc
@@ -658,7 +658,7 @@ int CephContext::_do_command(
       } else {
         // Output all
         f->open_array_section("options");
-        for (const auto &option : get_ceph_options()) {
+        for (const auto &option : ceph_options) {
           f->dump_object("option", option);
         }
         f->close_section();
diff --git a/src/common/config.cc b/src/common/config.cc
index 52071dbbe1902..f320fbd1cbccb 100644
--- a/src/common/config.cc
+++ b/src/common/config.cc
@@ -137,7 +137,7 @@ md_config_t::md_config_t(ConfigValues& values,
 {
   // Load the compile-time list of Option into
   // a map so that we can resolve keys quickly.
-  for (const auto &i : get_ceph_options()) {
+  for (const auto &i : ceph_options) {
     if (schema.count(i.name)) {
       // We may be instantiated pre-logging so send 
       std::cerr << "Duplicate config key in schema: '" << i.name << "'"
diff --git a/src/common/options.cc b/src/common/options.cc
index 28e4941af4ed8..bbac26e261cd8 100644
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -338,9 +338,4 @@ void Option::print(ostream *out) const
   }
 }
 
-const std::vector<Option>& get_ceph_options() {
-  // Use a static pointer that's never destroyed to avoid use-after-free
-  // when background threads access options during program exit
-  static const std::vector<Option>* options = new std::vector<Option>(build_options());
-  return *options;
-}
+const std::vector<Option> ceph_options = build_options();
diff --git a/src/common/options.h b/src/common/options.h
index c29d2e029fb4a..f99433464bcdb 100644
--- a/src/common/options.h
+++ b/src/common/options.h
@@ -434,4 +434,4 @@ constexpr unsigned long long operator""_T (unsigned long long n) {
   return n << 40;
 }
 
-const std::vector<Option>& get_ceph_options();
+extern const std::vector<Option> ceph_options;
diff --git a/src/crimson/admin/admin_socket.cc b/src/crimson/admin/admin_socket.cc
index 9db62af2bdf4d..5a676d9214c10 100644
--- a/src/crimson/admin/admin_socket.cc
+++ b/src/crimson/admin/admin_socket.cc
@@ -574,7 +574,7 @@ public:
     unique_ptr<Formatter> f{Formatter::create(format, "json-pretty", "json-pretty")};
     // Output all
     f->open_array_section("options");
-    for (const auto &option : get_ceph_options()) {
+    for (const auto &option : ceph_options) {
       f->dump_object("option", option);
     }
     f->close_section();
diff --git a/src/mon/ConfigMonitor.cc b/src/mon/ConfigMonitor.cc
index 9b1f6a8aab5af..7abd0c6818e9a 100644
--- a/src/mon/ConfigMonitor.cc
+++ b/src/mon/ConfigMonitor.cc
@@ -219,7 +219,7 @@ bool ConfigMonitor::preprocess_command(MonOpRequestRef op)
     if (f) {
       f->open_array_section("options");
     }
-    for (auto& i : get_ceph_options()) {
+    for (auto& i : ceph_options) {
       if (f) {
 	f->dump_string("option", i.name);
       } else {