From: Casey Bodley <cbodley@redhat.com>
Date: Fri, 26 Sep 2025 21:23:29 +0000 (-0400)
Subject: librados: linger callbacks hold a reference to LingerOp
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=e94187043eb7d6a3e47bf2780698f3cf6f5e7d93;p=ceph.git

librados: linger callbacks hold a reference to LingerOp

preserve a reference to LingerOp in case their invocation races with
another linger_cancel()

Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit 2455a713d44babf979b55832dc6f75363357d270)
Fixes: https://tracker.ceph.com/issues/76434
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---

diff --git a/src/librados/IoCtxImpl.cc b/src/librados/IoCtxImpl.cc
index f49d1c8ec2b..02ef3022274 100644
--- a/src/librados/IoCtxImpl.cc
+++ b/src/librados/IoCtxImpl.cc
@@ -88,25 +88,28 @@ struct CB_notify_Finish {
 
 struct CB_aio_linger_cancel {
   Objecter *objecter;
-  Objecter::LingerOp *linger_op;
+  boost::intrusive_ptr<Objecter::LingerOp> linger_op;
 
-  CB_aio_linger_cancel(Objecter *_objecter, Objecter::LingerOp *_linger_op)
-    : objecter(_objecter), linger_op(_linger_op)
+  CB_aio_linger_cancel(Objecter *_objecter,
+                       boost::intrusive_ptr<Objecter::LingerOp> op)
+    : objecter(_objecter), linger_op(std::move(op))
   {
   }
 
   void operator()() {
-    objecter->linger_cancel(linger_op);
+    objecter->linger_cancel(linger_op.get());
   }
 };
 
 struct C_aio_linger_Complete : public Context {
   AioCompletionImpl *c;
-  Objecter::LingerOp *linger_op;
+  boost::intrusive_ptr<Objecter::LingerOp> linger_op;
   bool cancel;
 
-  C_aio_linger_Complete(AioCompletionImpl *_c, Objecter::LingerOp *_linger_op, bool _cancel)
-    : c(_c), linger_op(_linger_op), cancel(_cancel)
+  C_aio_linger_Complete(AioCompletionImpl *_c,
+                        boost::intrusive_ptr<Objecter::LingerOp> op,
+                        bool _cancel)
+    : c(_c), linger_op(std::move(op)), cancel(_cancel)
   {
     c->get();
   }
@@ -115,7 +118,7 @@ struct C_aio_linger_Complete : public Context {
     if (cancel || r < 0)
       boost::asio::defer(c->io->client->finish_strand,
 			 CB_aio_linger_cancel(c->io->objecter,
-					      linger_op));
+					      std::move(linger_op)));
 
     c->lock.lock();
     c->rval = r;
@@ -136,8 +139,9 @@ struct C_aio_notify_Complete : public C_aio_linger_Complete {
   bool finished = false;
   int ret_val = 0;
 
-  C_aio_notify_Complete(AioCompletionImpl *_c, Objecter::LingerOp *_linger_op)
-    : C_aio_linger_Complete(_c, _linger_op, false) {
+  C_aio_notify_Complete(AioCompletionImpl *_c,
+                        boost::intrusive_ptr<Objecter::LingerOp> op)
+    : C_aio_linger_Complete(_c, std::move(op), false) {
   }
 
   void handle_ack(int r) {