From 333b3f43b56355ad0b3d3823397962f5ace102d1 Mon Sep 17 00:00:00 2001
From: Sage Weil <sage@inktank.com>
Date: Sat, 8 Dec 2012 21:44:54 -0800
Subject: [PATCH] mon: fix leak of pool op reply data

We pass a pointer because it is an optional argument, but we shouldn't
put the bufferlist on the heap or else we have to manage it's life
cycle, and that's fragile (and previously broken).

Signed-off-by: Sage Weil <sage@inktank.com>
---
 src/mon/OSDMonitor.cc |  8 ++++----
 src/mon/OSDMonitor.h  | 11 +++++++----
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/mon/OSDMonitor.cc b/src/mon/OSDMonitor.cc
index c845c2b600cbd..3186c4d6bc36f 100644
--- a/src/mon/OSDMonitor.cc
+++ b/src/mon/OSDMonitor.cc
@@ -2979,7 +2979,6 @@ bool OSDMonitor::prepare_pool_op(MPoolOp *m)
     return prepare_pool_op_auid(m);
   }
 
-  bufferlist *blp = NULL;
   int ret = 0;
   bool changed = false;
 
@@ -2990,6 +2989,8 @@ bool OSDMonitor::prepare_pool_op(MPoolOp *m)
   else
     pp = *osdmap.get_pg_pool(m->pool);
 
+  bufferlist reply_data;
+
   // pool snaps vs unmanaged snaps are mutually exclusive
   switch (m->op) {
   case POOL_OP_CREATE_SNAP:
@@ -3029,10 +3030,9 @@ bool OSDMonitor::prepare_pool_op(MPoolOp *m)
 
   case POOL_OP_CREATE_UNMANAGED_SNAP: 
     {
-      blp = new bufferlist();
       uint64_t snapid;
       pp.add_unmanaged_snap(snapid);
-      ::encode(snapid, *blp);
+      ::encode(snapid, reply_data);
       changed = true;
     }
     break;
@@ -3055,7 +3055,7 @@ bool OSDMonitor::prepare_pool_op(MPoolOp *m)
   }
 
  out:
-  paxos->wait_for_commit(new OSDMonitor::C_PoolOp(this, m, ret, pending_inc.epoch, blp));
+  paxos->wait_for_commit(new OSDMonitor::C_PoolOp(this, m, ret, pending_inc.epoch, &reply_data));
   propose_pending();
   return false;
 }
diff --git a/src/mon/OSDMonitor.h b/src/mon/OSDMonitor.h
index a82f5f0faf446..4faa90e290214 100644
--- a/src/mon/OSDMonitor.h
+++ b/src/mon/OSDMonitor.h
@@ -240,16 +240,19 @@ private:
     MPoolOp *m;
     int replyCode;
     int epoch;
-    bufferlist *reply_data;
-    C_PoolOp(OSDMonitor * osd, MPoolOp *m_, int rc, int e, bufferlist *rd=NULL) : 
-      osdmon(osd), m(m_), replyCode(rc), epoch(e), reply_data(rd) {}
+    bufferlist reply_data;
+    C_PoolOp(OSDMonitor * osd, MPoolOp *m_, int rc, int e, bufferlist *rd=NULL) :
+      osdmon(osd), m(m_), replyCode(rc), epoch(e) {
+      if (rd)
+	reply_data = *rd;
+    }
     void finish(int r) {
       if (r == -ECANCELED) {
 	if (m)
 	  m->put();
 	return;
       }
-      osdmon->_pool_op_reply(m, replyCode, epoch, reply_data);
+      osdmon->_pool_op_reply(m, replyCode, epoch, &reply_data);
     }
   };
 
-- 
2.39.5