From 5ccc4422d6172376bd6f1be8d3a99c0a54eab807 Mon Sep 17 00:00:00 2001 From: Jason Dillaman Date: Tue, 28 Apr 2015 11:12:00 -0400 Subject: [PATCH] osdc: invalid read of freed memory The bytes not in cache stat was potentially reading the bh length from a deleted bufferhead. Signed-off-by: Jason Dillaman --- src/osdc/ObjectCacher.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/osdc/ObjectCacher.cc b/src/osdc/ObjectCacher.cc index 7158350bf4b..5465706370f 100644 --- a/src/osdc/ObjectCacher.cc +++ b/src/osdc/ObjectCacher.cc @@ -1157,6 +1157,7 @@ int ObjectCacher::_readx(OSDRead *rd, ObjectSet *oset, Context *onfinish, ++bh_it) { uint64_t rx_bytes = static_cast( stat_rx + bh_it->second->length()); + bytes_not_in_cache += bh_it->second->length(); if (!waitfor_read.empty() || rx_bytes > max_size) { // cache is full with concurrent reads -- wait for rx's to complete // to constrain memory growth (especially during copy-ups) @@ -1175,7 +1176,6 @@ int ObjectCacher::_readx(OSDRead *rd, ObjectSet *oset, Context *onfinish, if ((success && onfinish) || last != missing.end()) last = bh_it; } - bytes_not_in_cache += bh_it->second->length(); success = false; } -- 2.47.3