journal: don't hold future lock during assignment

It's possible that the future raced with its owner and reaches an empty reference count. This was resulting in the future being destructed while its lock was still held. Fixes: http://tracker.ceph.com/issues/18618 Signed-off-by: Jason Dillaman <[email protected]>
zmc · Jan 21, 2017 · 0f21cee · 0f21cee
1 parent af9152f
commit 0f21cee
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/src/journal/FutureImpl.cc b/src/journal/FutureImpl.cc
@@ -39,13 +39,12 @@ void FutureImpl::flush(Context *on_safe) {
         m_contexts.push_back(on_safe);
       }
 
-      prev_future = prepare_flush(&flush_handlers);
+      prev_future = prepare_flush(&flush_handlers, m_lock);
     }
   }
 
   // instruct prior futures to flush as well
   while (prev_future) {
-    Mutex::Locker locker(prev_future->m_lock);
     prev_future = prev_future->prepare_flush(&flush_handlers);
   }
 
@@ -62,6 +61,12 @@ void FutureImpl::flush(Context *on_safe) {
 }
 
 FutureImplPtr FutureImpl::prepare_flush(FlushHandlers *flush_handlers) {
+  Mutex::Locker locker(m_lock);
+  return prepare_flush(flush_handlers, m_lock);
+}
+
+FutureImplPtr FutureImpl::prepare_flush(FlushHandlers *flush_handlers,
+                                        Mutex &lock) {
   assert(m_lock.is_locked());
 
   if (m_flush_state == FLUSH_STATE_NONE) {

diff --git a/src/journal/FutureImpl.h b/src/journal/FutureImpl.h
@@ -113,6 +113,7 @@ class FutureImpl : public RefCountedObject, boost::noncopyable {
   Contexts m_contexts;
 
   FutureImplPtr prepare_flush(FlushHandlers *flush_handlers);
+  FutureImplPtr prepare_flush(FlushHandlers *flush_handlers, Mutex &lock);
 
   void consistent(int r);
   void finish_unlock();