From ba7b6ced0a69991bf4f095172575dc536736d40d Mon Sep 17 00:00:00 2001 From: "Yan, Zheng" Date: Tue, 10 Jan 2017 17:16:40 +0800 Subject: [PATCH] client: fix Client::handle_cap_flushsnap_ack() crash Struct CapSnap holds a reference to its parent inode. So erasing struct CapSnap from Inode::cap_snaps may drop inode's last reference. The inode gets freed in the middle of erasing struct CapSnap Fixes: http://tracker.ceph.com/issues/18460 Signed-off-by: Yan, Zheng (cherry picked from commit 525c52fd491ed1ced385c8047872e3f557f8423f) --- src/client/Client.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/client/Client.cc b/src/client/Client.cc index 81be35b983560..14c3aa75b3eb7 100644 --- a/src/client/Client.cc +++ b/src/client/Client.cc @@ -4805,6 +4805,9 @@ void Client::handle_cap_flushsnap_ack(MetaSession *session, Inode *in, MClientCa } else { ldout(cct, 5) << "handle_cap_flushedsnap mds." << mds << " flushed snap follows " << follows << " on " << *in << dendl; + InodeRef tmp_ref; + if (in->get_num_ref() == 1) + tmp_ref = in; // make sure inode not get freed while erasing item from in->cap_snaps if (in->flushing_caps == 0 && in->cap_snaps.empty()) in->flushing_cap_item.remove_myself(); session->flushing_caps_tids.erase(capsnap.flush_tid); -- 2.39.5