From 80cc908bd1cdaf75ac088bfdde1ff61fe32b77e9 Mon Sep 17 00:00:00 2001
From: Sage Weil <sage@inktank.com>
Date: Mon, 30 Sep 2013 16:33:22 -0700
Subject: osd/ReplicatedPG: fix iterator corruption in cancel_copy_ops()

The cancel_copy() method removes the entry from copy_ops.  Move the
iterator forward before calling.

Fixes segfault when thrashing osds with a copy-from workload.

Signed-off-by: Sage Weil <sage@inktank.com>
---
 src/osd/ReplicatedPG.cc | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/osd/ReplicatedPG.cc b/src/osd/ReplicatedPG.cc
index 5e099c0853d..bc995a6fc86 100644
--- a/src/osd/ReplicatedPG.cc
+++ b/src/osd/ReplicatedPG.cc
@@ -4583,10 +4583,11 @@ void ReplicatedPG::cancel_copy(CopyOpRef cop)
 void ReplicatedPG::cancel_copy_ops()
 {
   dout(10) << __func__ << dendl;
-  for (map<hobject_t,CopyOpRef>::iterator p = copy_ops.begin();
-       p != copy_ops.end();
-       copy_ops.erase(p++)) {
-    cancel_copy(p->second);
+  map<hobject_t,CopyOpRef>::iterator p = copy_ops.begin();
+  while (p != copy_ops.end()) {
+    CopyOpRef cop = p->second;
+    p++;
+    cancel_copy(cop);
   }
 }
 
-- 
cgit v1.2.1