Actions
Bug #40436
openmultisite: use-after-free of RGWFetchRemoteObjCR::zones_trace
Added by Casey Bodley almost 5 years ago. Updated almost 5 years ago.
Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
% Done:
0%
Source:
Q/A
Tags:
multisite
Backport:
luminous mimic nautilus
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Crash signature (v1):
Crash signature (v2):
Description
on shutdown or realm reload, RGWBucketSyncSingleEntryCR can destruct before RGWFetchRemoteObjCR completes. RGWFetchRemoteObjCR should not store a pointer into memory owned by RGWBucketSyncSingleEntryCR
Updated by Casey Bodley almost 5 years ago
example backtrace:
ceph version 12.2.8-128.el7cp (030358773c5213a14c1444a5147258672b2dc15f) luminous (stable) 1: (()+0x2d2111) [0x562c794e4111] 2: (()+0xf5d0) [0x7f7c055625d0] 3: (gsignal()+0x37) [0x7f7bf991a207] 4: (abort()+0x148) [0x7f7bf991b8f8] 5: (__gnu_cxx::__verbose_terminate_handler()+0x165) [0x7f7bfa2297d5] 6: (()+0x5e746) [0x7f7bfa227746] 7: (()+0x5e773) [0x7f7bfa227773] 8: (__cxa_rethrow()+0x49) [0x7f7bfa2279e9] 9: (std::_Rb_tree<std::string, std::string, std::_Identity<std::string>, std::less<std::string>, std::allocator<std::string> >::_M_copy(std::_Rb_tree_node<std::string> const*, std::_Rb_tree_node<std::string>*)+ 0x14d) [0x562c79456bad] 10: (std::_Rb_tree<std::string, std::string, std::_Identity<std::string>, std::less<std::string>, std::allocator<std::string> >::operator=(std::_Rb_tree<std::string, std::string, std::_Identity<std::string>, st d::less<std::string>, std::allocator<std::string> > const&)+0x47) [0x562c7954b477] 11: (RGWRados::cls_obj_complete_op(RGWRados::BucketShard&, rgw_obj const&, RGWModifyOp, std::string&, long, unsigned long, rgw_bucket_dir_entry&, RGWObjCategory, std::list<cls_rgw_obj_key, std::allocator<cls_rg w_obj_key> >*, unsigned short, std::set<std::string, std::less<std::string>, std::allocator<std::string> >*)+0x1ab) [0x562c7961979b] 12: (RGWRados::cls_obj_complete_add(RGWRados::BucketShard&, rgw_obj const&, std::string&, long, unsigned long, rgw_bucket_dir_entry&, RGWObjCategory, std::list<cls_rgw_obj_key, std::allocator<cls_rgw_obj_key> > *, unsigned short, std::set<std::string, std::less<std::string>, std::allocator<std::string> >*)+0x44) [0x562c79619a64] 13: (RGWRados::Bucket::UpdateIndex::complete(long, unsigned long, unsigned long, unsigned long, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000 000l> > >&, std::string const&, std::string const&, ceph::buffer::list*, RGWObjCategory, std::list<cls_rgw_obj_key, std::allocator<cls_rgw_obj_key> >*, std::string const*)+0x3ad) [0x562c796414dd] 14: (RGWRados::Object::Write::_do_write_meta(unsigned long, unsigned long, std::map<std::string, ceph::buffer::list, std::less<std::string>, std::allocator<std::pair<std::string const, ceph::buffer::list> > >&, bool, bool, void*)+0x615) [0x562c7965ec95] 15: (RGWRados::Object::Write::write_meta(unsigned long, unsigned long, std::map<std::string, ceph::buffer::list, std::less<std::string>, std::allocator<std::pair<std::string const, ceph::buffer::list> > >&)+0x2 fa) [0x562c7965f9da] 16: (RGWPutObjProcessor_Atomic::do_complete(unsigned long, std::string const&, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >*, std:: chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >, std::map<std::string, ceph::buffer::list, std::less<std::string>, std::allocator<std::pair< std::string const, ceph::buffer::list> > >&, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >, char const*, char const*, std::string con st*, std::set<std::string, std::less<std::string>, std::allocator<std::string> >*)+0x341) [0x562c7965fdf1] 17: (RGWPutObjProcessor::complete(unsigned long, std::string const&, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >*, std::chrono::ti me_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >, std::map<std::string, ceph::buffer::list, std::less<std::string>, std::allocator<std::pair<std::strin g const, ceph::buffer::list> > >&, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >, char const*, char const*, std::string const*, std:: set<std::string, std::less<std::string>, std::allocator<std::string> >*)+0x42) [0x562c79607282] 18: (RGWRados::fetch_remote_obj(RGWObjectCtx&, rgw_user const&, std::string const&, std::string const&, bool, req_info*, std::string const&, rgw_obj&, rgw_obj&, RGWBucketInfo&, RGWBucketInfo&, std::chrono::time _point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > >*, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio <1l, 1000000000l> > >*, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > > const*, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio<1l, 1000000000l> > > const*, bool, char const*, char const*, RGWRados::AttrsMod, bool, std::map<std::string, ceph::buffer::list, std::less<std::string>, std::alloc ator<std::pair<std::string const, ceph::buffer::list> > >&, RGWObjCategory, boost::optional<unsigned long>, std::chrono::time_point<ceph::time_detail::real_clock, std::chrono::duration<unsigned long, std::ratio< 1l, 1000000000l> > >, std::string*, std::string*, ceph::buffer::list*, void (*)(long, void*), void*, std::set<std::string, std::less<std::string>, std::allocator<std::string> >*, boost::optional<unsigned long>*) +0xb58) [0x562c7965a438] 19: (RGWAsyncFetchRemoteObj::_send_request()+0x391) [0x562c795ade11] 20: (RGWAsyncRadosProcessor::handle_request(RGWAsyncRadosRequest*)+0x22) [0x562c795aac02] 21: (RGWAsyncRadosProcessor::RGWWQ::_process(RGWAsyncRadosRequest*, ThreadPool::TPHandle&)+0xd) [0x562c795aaccd] 22: (ThreadPool::worker(ThreadPool::WorkThread*)+0xa8e) [0x7f7bfcb321de] 23: (ThreadPool::WorkThread::entry()+0x10) [0x7f7bfcb33100] 24: (()+0x7dd5) [0x7f7c0555add5] 25: (clone()+0x6d) [0x7f7bf99e1ead]
Actions