Fix use-after-free in OSD ops (ooops)

src/client/msgr_op.cpp

@@ -8,7 +8,6 @@
 osd_op_t::~osd_op_t()
 {
     assert(!bs_op);
-    assert(!op_data);
     if (bitmap_buf)
     {
         free(bitmap_buf);
@@ -23,6 +22,10 @@ osd_op_t::~osd_op_t()
         // So we don't reuse it, but free it every time
         free(buf);
     }
+    if (op_data)
+    {
+        free(op_data);
+    }
 }
 
 bool osd_op_t::is_recovery_related()

src/osd/osd_primary_subops.cpp

@@ -83,8 +83,6 @@ void osd_t::finish_op(osd_op_t *cur_op, int retval)
             rm_inflight(pg);
         }
         assert(!cur_op->op_data->subops);
-        free(cur_op->op_data);
-        cur_op->op_data = NULL;
     }
     cur_op->reply.hdr.magic = SECONDARY_OSD_REPLY_MAGIC;
     cur_op->reply.hdr.id = cur_op->req.hdr.id;