From 575392c944b195e473efb837b5a8d24dc3090333 Mon Sep 17 00:00:00 2001 From: Ilya Dryomov Date: Wed, 22 Jan 2025 20:34:11 +0100 Subject: [PATCH] librbd: clear ctx before initiating close in Image::{aio_,}close() Image::aio_close() must clear ctx before initiating close. Otherwise the provided callback may see a non-NULL ctx and attempt to close the image again from Image destructor, leading to an invalid memory access as ImageCtx and ImageState are both freed immediately after the image is closed (i.e. before AioCompletion is completed and the callback is executed). The same adjustment is made to Image::close() just for consistency. Fixes: https://tracker.ceph.com/issues/69619 Signed-off-by: Ilya Dryomov (cherry picked from commit 61baa8793402d416289ff25535d6f9124da3cae9) --- src/librbd/librbd.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/librbd/librbd.cc b/src/librbd/librbd.cc index 54a2d02051e..402c641c368 100644 --- a/src/librbd/librbd.cc +++ b/src/librbd/librbd.cc @@ -1610,8 +1610,8 @@ namespace librbd { ImageCtx *ictx = (ImageCtx *)ctx; tracepoint(librbd, close_image_enter, ictx, ictx->name.c_str(), ictx->id.c_str()); + ctx = NULL; // before initiating close r = ictx->state->close(); - ctx = NULL; tracepoint(librbd, close_image_exit, r); } @@ -1627,9 +1627,9 @@ namespace librbd { ImageCtx *ictx = (ImageCtx *)ctx; tracepoint(librbd, aio_close_image_enter, ictx, ictx->name.c_str(), ictx->id.c_str(), c->pc); + ctx = NULL; // before initiating close ictx->state->close(new C_AioCompletion(ictx, librbd::io::AIO_TYPE_CLOSE, get_aio_completion(c))); - ctx = NULL; tracepoint(librbd, aio_close_image_exit, 0); return 0; -- 2.39.5