From: Sage Weil <sage@redhat.com>
Date: Mon, 8 Sep 2014 20:44:57 +0000 (-0700)
Subject: osdc/Objecter: revoke rx_buffer on op_cancel
X-Git-Tag: v0.67.11~5
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=f7498c47ed90db71e50a3d4ff9ce13626e863719;p=ceph.git

osdc/Objecter: revoke rx_buffer on op_cancel

If we cancel a read, revoke the rx buffers to avoid a use-after-free and/or
other undefined badness by using user buffers that may no longer be
present.

Fixes: #9362
Backport: firefly, dumpling
Reported-by: Matthias Kiefer <matthias.kiefer@1und1.de>
Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 2305b2897acba38384358c33ca3bbfcae6f1c74e)

(adjusted for op->con instead of s->con)
---

diff --git a/src/osdc/Objecter.cc b/src/osdc/Objecter.cc
index dc46bb00aaa5..0a0f3cc2525f 100644
--- a/src/osdc/Objecter.cc
+++ b/src/osdc/Objecter.cc
@@ -1296,6 +1296,11 @@ int Objecter::op_cancel(tid_t tid, int r)
 
   ldout(cct, 10) << __func__ << " tid " << tid << dendl;
   Op *op = p->second;
+  if (op->con) {
+    ldout(cct, 20) << " revoking rx buffer for " << tid
+		   << " on " << op->con << dendl;
+    op->con->revoke_rx_buffer(tid);
+  }
   if (op->onack) {
     op->onack->complete(r);
     op->onack = NULL;