From: Yehuda Sadeh <yehuda@inktank.com>
Date: Wed, 18 Dec 2013 21:11:01 +0000 (-0800)
Subject: rgw: fix use-after-free when releasing completion handle
X-Git-Tag: v0.72.2~1
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=b570c8014325fef590d16e6157cb33026155932c;p=ceph.git

rgw: fix use-after-free when releasing completion handle

Backport: emperor, dumpling
Signed-off-by: Yehuda Sadeh <yehuda@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
(cherry picked from commit c8890ab2d46fe8e12200a0d2f9eab31c461fb871)
---

diff --git a/src/rgw/rgw_rados.cc b/src/rgw/rgw_rados.cc
index a5247ffca2947..ac9503a306f47 100644
--- a/src/rgw/rgw_rados.cc
+++ b/src/rgw/rgw_rados.cc
@@ -4187,7 +4187,6 @@ struct get_obj_data : public RefCountedObject {
 
     c->wait_for_complete_and_cb();
     int r = c->get_return_value();
-    c->release();
 
     lock.Lock();
     completion_map.erase(cur_ofs);
@@ -4196,6 +4195,8 @@ struct get_obj_data : public RefCountedObject {
       *done = true;
     }
     lock.Unlock();
+
+    c->release();
     
     return r;
   }