Conversation
The config schema map was using string_view keys that pointed to the
name field of Option objects stored in the global ceph_options vector.
When the vector is destroyed during program exit, the Option objects
are freed, but background threads (like BlueStore::MempoolThread) may
still be accessing config options, causing use-after-free.
ASan reported:
READ of size 19 at 0x503000047c80 thread T411
#12 md_config_t::find_option(std::string_view) const config.cc:261
ceph#17 BlueStore::MempoolThread::entry() BlueStore.cc:5591
0x503000047c80 is located 0 bytes inside of 20-byte region
freed by thread T0 here:
#7 Option::~Option() options.h:15
ceph#13 std::vector<Option>::~vector() stl_vector.h:730
ceph#14 __run_exit_handlers stdlib/exit.c:113
previously allocated by thread T0 here:
#7 Option::Option(Option const&) options.h:15
ceph#18 build_options() build_options.cc:44
Fix by converting ceph_options from a global variable to a function
get_ceph_options() that returns a reference to a static pointer that
is never destroyed. This ensures the Option objects remain valid for
the lifetime of the program, even during exit when background threads
may still be accessing them.
This preserves the memory efficiency of using string_view keys in the
schema map while fixing the lifetime issue.
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
14 tasks
athanatos
approved these changes
Jan 13, 2026
Contributor
|
Thanks for maintaining the string_view... |
ronen-fr
approved these changes
Jan 13, 2026
Contributor
|
Um, seems that, with this PR, we meet the issue: https://tracker.ceph.com/issues/74481 |
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The config schema map was using string_view keys that pointed to the name field of Option objects stored in the global ceph_options vector. When the vector is destroyed during program exit, the Option objects are freed, but background threads (like BlueStore::MempoolThread) may still be accessing config options, causing use-after-free.
Fix by converting
ceph_optionsfrom a global variable to a functionget_ceph_options()that returns a reference to a static pointer that is never destroyed. This ensures theOptionobjects remain valid for the lifetime of the program, even during exit when background threads may still be accessing them.This preserves the memory efficiency of using
string_viewkeys in the schema map while fixing the lifetime issue.Contribution Guidelines
To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an
xbetween the brackets:[x]. Spaces and capitalization matter when checking off items this way.Checklist
Show available Jenkins commands
jenkins test classic perfJenkins Job | Jenkins Job Definitionjenkins test crimson perfJenkins Job | Jenkins Job Definitionjenkins test signedJenkins Job | Jenkins Job Definitionjenkins test make checkJenkins Job | Jenkins Job Definitionjenkins test make check arm64Jenkins Job | Jenkins Job Definitionjenkins test submodulesJenkins Job | Jenkins Job Definitionjenkins test dashboardJenkins Job | Jenkins Job Definitionjenkins test dashboard cephadmJenkins Job | Jenkins Job Definitionjenkins test apiJenkins Job | Jenkins Job Definitionjenkins test docsReadTheDocs | Github Workflow Definitionjenkins test ceph-volume allJenkins Jobs | Jenkins Jobs Definitionjenkins test windowsJenkins Job | Jenkins Job Definitionjenkins test rook e2eJenkins Job | Jenkins Job DefinitionYou must only issue one Jenkins command per-comment. Jenkins does not understand
comments with more than one command.