From: Yuval Lifshitz <ylifshit@redhat.com>
Date: Mon, 18 May 2020 16:25:09 +0000 (+0300)
Subject: cls/2pc_queue: fix access to invalidated iterator
X-Git-Tag: v17.0.0~2311^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=e152f846335a4f4f799f24fb0cb6b8ed6d78e1bf;p=ceph.git

cls/2pc_queue: fix access to invalidated iterator

Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>

Fixes: https://tracker.ceph.com/issues/45586
---

diff --git a/src/cls/2pc_queue/cls_2pc_queue.cc b/src/cls/2pc_queue/cls_2pc_queue.cc
index 7f7303ae07640..71061a7297f8b 100644
--- a/src/cls/2pc_queue/cls_2pc_queue.cc
+++ b/src/cls/2pc_queue/cls_2pc_queue.cc
@@ -324,6 +324,7 @@ static int cls_2pc_queue_abort(cls_method_context_t hctx, bufferlist *in, buffer
  
   auto total_entries = urgent_data.reservations.size();
   auto it = urgent_data.reservations.find(abort_op.id);
+  uint64_t reservation_size;
   if (it == urgent_data.reservations.end()) {
     if (!urgent_data.has_xattrs) {
       CLS_LOG(20, "INFO: cls_2pc_queue_abort: reservation does not exist: %u", abort_op.id);
@@ -355,6 +356,7 @@ static int cls_2pc_queue_abort(cls_method_context_t hctx, bufferlist *in, buffer
       return 0;
     }
     total_entries += xattr_reservations.size();
+    reservation_size = it->second.size;
     xattr_reservations.erase(it);
     bl_xattrs.clear();
     encode(xattr_reservations, bl_xattrs);
@@ -364,11 +366,12 @@ static int cls_2pc_queue_abort(cls_method_context_t hctx, bufferlist *in, buffer
       return ret;
     }
   } else {
+    reservation_size = it->second.size;
     urgent_data.reservations.erase(it);
   }
 
   // remove the reservation
-  urgent_data.reserved_size -= it->second.size;
+  urgent_data.reserved_size -= reservation_size;
 
   CLS_LOG(20, "INFO: cls_2pc_queue_abort: current reservations: %lu (bytes)", urgent_data.reserved_size);
   CLS_LOG(20, "INFO: cls_2pc_queue_abort: current reservation entries: %lu", total_entries-1);