From: Peter Keresztes Schmidt <carbenium@outlook.com>
Date: Sun, 15 Oct 2017 04:36:54 +0000 (+0200)
Subject: rbd: fix crash during map
X-Git-Tag: v13.0.1~552^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F18313%2Fhead;p=ceph.git

rbd: fix crash during map

Currently the iterator isn't advanced after the erase call leading to a
second call on the iterator, which crashes due to a double free.
Since C++11 the map::erase function returns an iterator pointing to the
next element. Use the return value to set the iterator after erasing.

Fixes: http://tracker.ceph.com/issues/21808

Signed-off-by: Peter Keresztes Schmidt <carbenium@outlook.com>
---

diff --git a/src/tools/rbd/action/Kernel.cc b/src/tools/rbd/action/Kernel.cc
index a0ffca60f416..e77dc6b18194 100644
--- a/src/tools/rbd/action/Kernel.cc
+++ b/src/tools/rbd/action/Kernel.cc
@@ -303,7 +303,7 @@ static int do_kernel_map(const char *poolname, const char *imgname,
     // default and omit it even if it was specified by the user
     // (see ceph.git commit fb0f1986449b)
     if (it->first == "rw" && it->second == "rw") {
-      map_options.erase(it);
+      it = map_options.erase(it);
     } else {
       if (it != map_options.begin())
         oss << ",";