From: Jason Dillaman <dillaman@redhat.com>
Date: Wed, 27 Sep 2017 13:40:08 +0000 (-0400)
Subject: librbd: hold cache_lock while clearing cache nonexistence flags
X-Git-Tag: v13.0.1~722^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F17992%2Fhead;p=ceph.git

librbd: hold cache_lock while clearing cache nonexistence flags

When transitioning from a snapshot that had an associated parent
to a snapshot where the parent was flattened and removed, the cache
was being referenced without holding the required lock.

Fixes: http://tracker.ceph.com/issues/21558
Signed-off-by: Jason Dillaman <dillaman@redhat.com>
---

diff --git a/src/librbd/image/RefreshParentRequest.cc b/src/librbd/image/RefreshParentRequest.cc
index 3245ff11158..86001da82c6 100644
--- a/src/librbd/image/RefreshParentRequest.cc
+++ b/src/librbd/image/RefreshParentRequest.cc
@@ -69,12 +69,13 @@ void RefreshParentRequest<I>::send() {
 
 template <typename I>
 void RefreshParentRequest<I>::apply() {
+  assert(m_child_image_ctx.cache_lock.is_locked());
+  assert(m_child_image_ctx.snap_lock.is_wlocked());
+  assert(m_child_image_ctx.parent_lock.is_wlocked());
   if (m_child_image_ctx.parent != nullptr) {
     // closing parent image
     m_child_image_ctx.clear_nonexistence_cache();
   }
-  assert(m_child_image_ctx.snap_lock.is_wlocked());
-  assert(m_child_image_ctx.parent_lock.is_wlocked());
   std::swap(m_child_image_ctx.parent, m_parent_image_ctx);
 }
 
diff --git a/src/librbd/image/SetSnapRequest.cc b/src/librbd/image/SetSnapRequest.cc
index ae7776c87c0..fc632edb77a 100644
--- a/src/librbd/image/SetSnapRequest.cc
+++ b/src/librbd/image/SetSnapRequest.cc
@@ -326,6 +326,7 @@ int SetSnapRequest<I>::apply() {
   ldout(cct, 10) << __func__ << dendl;
 
   RWLock::WLocker owner_locker(m_image_ctx.owner_lock);
+  Mutex::Locker cache_locker(m_image_ctx.cache_lock);
   RWLock::WLocker snap_locker(m_image_ctx.snap_lock);
   RWLock::WLocker parent_locker(m_image_ctx.parent_lock);
   if (m_snap_id != CEPH_NOSNAP) {