From d927919a4bee4b3cb5fe3b8fda04c079fa10e3fd Mon Sep 17 00:00:00 2001 From: Sage Weil Date: Fri, 18 Dec 2015 17:33:41 -0500 Subject: [PATCH] os/bluestore/BlockDevice: fix waiter wakeup use-after-free race Signed-off-by: Sage Weil --- src/os/bluestore/BlockDevice.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/os/bluestore/BlockDevice.cc b/src/os/bluestore/BlockDevice.cc index 95797c2bf56..2a74463c4fa 100644 --- a/src/os/bluestore/BlockDevice.cc +++ b/src/os/bluestore/BlockDevice.cc @@ -224,12 +224,15 @@ void BlockDevice::_aio_thread() << " ioc " << ioc << " with " << left << " aios left" << dendl; assert(r >= 0); + // sample waiter count before doing callback (which may + // destroy this ioc). + int waiting = ioc->num_waiting.read(); if (left == 0) { if (ioc->priv) { aio_callback(aio_callback_priv, ioc->priv); } } - if (ioc->num_waiting.read()) { + if (waiting) { dout(20) << __func__ << " waking waiter" << dendl; Mutex::Locker l(ioc->lock); ioc->cond.Signal(); -- 2.47.3