Project

General

Profile

Actions

Bug #50807

closed

mds: MDSLog::journaler pointer maybe crash with use-after-free

Added by Xiubo Li almost 3 years ago. Updated almost 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
-
Target version:
% Done:

0%

Source:
Development
Tags:
Backport:
pacific,octopus
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
fs
Component(FS):
MDS
Labels (FS):
crash
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

When the _recovery_thread is trying to reformat the journal, it will delete the old journal pointer and assign with a new one, during this the mds_lock is unlocked. That means in other thread who are using the MDSLog::journaler pointer will potentially hit use-after-free bug.


Related issues 2 (0 open2 closed)

Copied to CephFS - Backport #50874: octopus: mds: MDSLog::journaler pointer maybe crash with use-after-freeResolvedCory SnyderActions
Copied to CephFS - Backport #50875: pacific: mds: MDSLog::journaler pointer maybe crash with use-after-freeResolvedPatrick DonnellyActions
Actions #1

Updated by Xiubo Li almost 3 years ago

  • Pull request ID set to 41332
Actions #2

Updated by Xiubo Li almost 3 years ago

  • Status changed from New to Fix Under Review
  • Assignee set to Xiubo Li
Actions #3

Updated by Patrick Donnelly almost 3 years ago

  • Target version set to v17.0.0
  • Source set to Development
  • Backport set to pacific,octopus
Actions #4

Updated by Patrick Donnelly almost 3 years ago

  • Status changed from Fix Under Review to Pending Backport
Actions #5

Updated by Backport Bot almost 3 years ago

  • Copied to Backport #50874: octopus: mds: MDSLog::journaler pointer maybe crash with use-after-free added
Actions #6

Updated by Backport Bot almost 3 years ago

  • Copied to Backport #50875: pacific: mds: MDSLog::journaler pointer maybe crash with use-after-free added
Actions #7

Updated by Loïc Dachary almost 3 years ago

  • Status changed from Pending Backport to Resolved

While running with --resolve-parent, the script "backport-create-issue" noticed that all backports of this issue are in status "Resolved" or "Rejected".

Actions

Also available in: Atom PDF