From: Brad Hubbard <bhubbard@redhat.com>
Date: Fri, 27 Nov 2020 00:55:54 +0000 (+1000)
Subject: mon: paxos: Delete logger in destructor
X-Git-Tag: v16.1.0~367^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=cc295d1c87552eb76b9188d88d7e6ab2f3108149;p=ceph.git

mon: paxos: Delete logger in destructor

reset() can race with shutdown() leading to a use-after-free on the
'logger' object.

Fixes: https://tracker.ceph.com/issues/48386

Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
---

diff --git a/src/mon/Paxos.cc b/src/mon/Paxos.cc
index 7f64bf7446a05..39f9045839ae9 100644
--- a/src/mon/Paxos.cc
+++ b/src/mon/Paxos.cc
@@ -1343,7 +1343,6 @@ void Paxos::shutdown()
   finish_contexts(g_ceph_context, committing_finishers, -ECANCELED);
   if (logger)
     g_ceph_context->get_perfcounters_collection()->remove(logger);
-  delete logger;
 }
 
 void Paxos::leader_init()
diff --git a/src/mon/Paxos.h b/src/mon/Paxos.h
index 56ef403631f62..657b646e2c3bf 100644
--- a/src/mon/Paxos.h
+++ b/src/mon/Paxos.h
@@ -1045,7 +1045,7 @@ public:
    * @param name A name for the paxos service. It serves as the naming space
    * of the underlying persistent storage for this service.
    */
-  Paxos(Monitor *m, const std::string &name) 
+  Paxos(Monitor *m, const std::string &name)
 		 : mon(m),
 		   logger(NULL),
 		   paxos_name(name),
@@ -1065,6 +1065,10 @@ public:
 		   clock_drift_warned(0),
 		   trimming(false) { }
 
+  ~Paxos() {
+    delete logger;
+  }
+
   const std::string get_name() const {
     return paxos_name;
   }