libceph: avoid a use-after-free during map check

Sending map check after complete_request() was called is not only
useless, but can lead to a use-after-free as req->r_kref decrement in
__complete_request() races with map check code.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 34b5334548c30f680028fe64be41af22f94322aa..294320400c723c23b640e6619aaaef576f8bfc2c 100644 (file)
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -2266,7 +2266,7 @@ again:
                complete_request(req, err);
        mutex_unlock(&osd->lock);
 
-       if (ct_res == CALC_TARGET_POOL_DNE)
+       if (!err && ct_res == CALC_TARGET_POOL_DNE)
                send_map_check(req);
 
        if (promoted)