From 25ecca76251b7d78af28b906d4b7652f07b0796a Mon Sep 17 00:00:00 2001
From: Vitaliy Filippov <vitalif@yourcmc.ru>
Date: Wed, 1 Apr 2026 18:18:33 +0300
Subject: [PATCH] Fix use-after-free in OSD ops (ooops)

---
 src/client/msgr_op.cpp         | 5 ++++-
 src/osd/osd_primary_subops.cpp | 2 --
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/client/msgr_op.cpp b/src/client/msgr_op.cpp
index 84dd0a0f..a4657bd6 100644
--- a/src/client/msgr_op.cpp
+++ b/src/client/msgr_op.cpp
@@ -8,7 +8,6 @@
 osd_op_t::~osd_op_t()
 {
     assert(!bs_op);
-    assert(!op_data);
     if (bitmap_buf)
     {
         free(bitmap_buf);
@@ -23,6 +22,10 @@ osd_op_t::~osd_op_t()
         // So we don't reuse it, but free it every time
         free(buf);
     }
+    if (op_data)
+    {
+        free(op_data);
+    }
 }
 
 bool osd_op_t::is_recovery_related()
diff --git a/src/osd/osd_primary_subops.cpp b/src/osd/osd_primary_subops.cpp
index e3314b44..02382ae4 100644
--- a/src/osd/osd_primary_subops.cpp
+++ b/src/osd/osd_primary_subops.cpp
@@ -83,8 +83,6 @@ void osd_t::finish_op(osd_op_t *cur_op, int retval)
             rm_inflight(pg);
         }
         assert(!cur_op->op_data->subops);
-        free(cur_op->op_data);
-        cur_op->op_data = NULL;
     }
     cur_op->reply.hdr.magic = SECONDARY_OSD_REPLY_MAGIC;
     cur_op->reply.hdr.id = cur_op->req.hdr.id;