From 413b4ff2235e962d49ddfb7f8381884c6b8d0dc6 Mon Sep 17 00:00:00 2001 From: Sun Yuechi Date: Sun, 21 Jun 2026 16:42:54 +0800 Subject: [PATCH] tools/immutable_object_cache: don't leak in-flight replies on teardown CacheSession::send() deleted the reply in the async_write completion handler. On teardown asio drops the pending handler without running it, leaking the reply. Delete it right after encoding into bl instead; bl owns the payload, so the write is unaffected. Fixes: https://tracker.ceph.com/issues/77552 Signed-off-by: Sun Yuechi (cherry picked from commit 2d85d9e15855e662a4235c38c683a533213be934) --- src/tools/immutable_object_cache/CacheSession.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/tools/immutable_object_cache/CacheSession.cc b/src/tools/immutable_object_cache/CacheSession.cc index e6adaead161f..52f955142d3c 100644 --- a/src/tools/immutable_object_cache/CacheSession.cc +++ b/src/tools/immutable_object_cache/CacheSession.cc @@ -122,13 +122,15 @@ void CacheSession::send(ObjectCacheRequest* reply) { bufferlist bl; reply->encode(); bl.append(reply->get_payload_bufferlist()); + // bl owns the encoded payload; free reply here so it can't leak if the + // handler is dropped on teardown. + delete reply; boost::asio::async_write(m_dm_socket, boost::asio::buffer(bl.c_str(), bl.length()), boost::asio::transfer_exactly(bl.length()), - [this, bl, reply](const boost::system::error_code& err, + [this, bl](const boost::system::error_code& err, size_t bytes_transferred) { - delete reply; if (err || bytes_transferred != bl.length()) { fault(err); return; -- 2.47.3