Commit 6001567c authored May 22, 2018 by Ilya Dryomov

libceph: avoid a use-after-free during map check



Sending map check after complete_request() was called is not only
useless, but can lead to a use-after-free as req->r_kref decrement in
__complete_request() races with map check code.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>

parent 29e87820

net/ceph/osd_client.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2266,7 +2266,7 @@ static void __submit_request(struct ceph_osd_request *req, bool wrlocked)
		complete_request(req, err);
		mutex_unlock(&osd->lock);

		if (ct_res == CALC_TARGET_POOL_DNE)
		if (!err && ct_res == CALC_TARGET_POOL_DNE)
		send_map_check(req);

		if (promoted)