From f18247e32b769088d7afb76a9116636bcfab9468 Mon Sep 17 00:00:00 2001 From: Sun Yuechi Date: Tue, 30 Jun 2026 19:50:09 +0800 Subject: [PATCH] librbd: fix use-after-free in trash purge on image open error When ImageState::open() fails with an error other than -ENOENT, it asynchronously deletes the ImageCtx before returning. The trash purge loop only skipped the -ENOENT case and fell through on every other error, dereferencing the already-freed ictx in diff_iterate() and state->close(). Add the missing continue so a failed open is skipped. The fall-through dates back to 504f4e78, which split `if (r < 0) continue` to log non-ENOENT errors but dropped the continue. Fixes: https://tracker.ceph.com/issues/77836 Signed-off-by: Sun Yuechi --- src/librbd/api/Trash.cc | 1 + 1 file changed, 1 insertion(+) diff --git a/src/librbd/api/Trash.cc b/src/librbd/api/Trash.cc index aff6ff1c943..a135a004abc 100644 --- a/src/librbd/api/Trash.cc +++ b/src/librbd/api/Trash.cc @@ -487,6 +487,7 @@ int Trash::purge(IoCtx& io_ctx, time_t expire_ts, } else if (r < 0) { lderr(cct) << "failed to open image " << it << ": " << cpp_strerror(r) << dendl; + continue; } r = librbd::api::DiffIterate::diff_iterate( -- 2.47.3