Skip to content

Commit d14fb9a

Browse files
committed
mds: fix issues with use-after-free in C_Flush_Journal
Moved dout() statement out of trim_expired_segments() to avoid dereferencing 'this' object after object deletion via context completion handler. Fixes: https://tracker.ceph.com/issues/69953 Signed-off-by: Milind Changire <[email protected]>
1 parent aab2b26 commit d14fb9a

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/mds/MDSRank.cc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -180,10 +180,6 @@ class C_Flush_Journal : public MDSInternalContext {
180180
handle_write_head(r);
181181
}));
182182
mdlog->trim_expired_segments(ctx);
183-
184-
dout(5) << __func__ << ": trimming is complete; wait for journal head write. Journal expire_pos/trim_pos is now "
185-
<< std::hex << mdlog->get_journaler()->get_expire_pos() << "/"
186-
<< mdlog->get_journaler()->get_trimmed_pos() << dendl;
187183
}
188184

189185
void handle_write_head(int r) {
@@ -202,6 +198,10 @@ class C_Flush_Journal : public MDSInternalContext {
202198
*/
203199
ceph_assert(ceph_mutex_is_locked_by_me(mds->mds_lock));
204200
dout(20) << __func__ << ": r=" << r << dendl;
201+
202+
dout(5) << __func__ << ": trimming is complete; wait for journal head write. Journal expire_pos/trim_pos is now "
203+
<< std::hex << mdlog->get_journaler()->get_expire_pos() << "/"
204+
<< mdlog->get_journaler()->get_trimmed_pos() << dendl;
205205
on_finish->complete(r);
206206
}
207207

0 commit comments

Comments
 (0)