From: Yan, Zheng <zyan@redhat.com>
Date: Tue, 10 Jan 2017 09:16:40 +0000 (+0800)
Subject: client: fix Client::handle_cap_flushsnap_ack() crash
X-Git-Tag: v11.2.1~144^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=ba7b6ced0a69991bf4f095172575dc536736d40d;p=ceph.git

client: fix Client::handle_cap_flushsnap_ack() crash

Struct CapSnap holds a reference to its parent inode. So erasing
struct CapSnap from Inode::cap_snaps may drop inode's last reference.
The inode gets freed in the middle of erasing struct CapSnap

Fixes: http://tracker.ceph.com/issues/18460
Signed-off-by: Yan, Zheng <zyan@redhat.com>
(cherry picked from commit 525c52fd491ed1ced385c8047872e3f557f8423f)
---

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 81be35b9835..14c3aa75b3e 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -4805,6 +4805,9 @@ void Client::handle_cap_flushsnap_ack(MetaSession *session, Inode *in, MClientCa
     } else {
       ldout(cct, 5) << "handle_cap_flushedsnap mds." << mds << " flushed snap follows " << follows
 	      << " on " << *in << dendl;
+      InodeRef tmp_ref;
+      if (in->get_num_ref() == 1)
+	tmp_ref = in; // make sure inode not get freed while erasing item from in->cap_snaps
       if (in->flushing_caps == 0 && in->cap_snaps.empty())
 	in->flushing_cap_item.remove_myself();
       session->flushing_caps_tids.erase(capsnap.flush_tid);