rgw: fix a crash when getting ECANCELED in delete_obj()

bufferlist::c_str() returns NULL if bufferlist is empty. We were
clearing the state, later on assigning s->obj_tag to a string.

Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>

diff --git a/src/rgw/rgw_rados.cc b/src/rgw/rgw_rados.cc
index b51bf1cf54569e6bcd0f52e85c4eca1b54f2ed86..eef205a252aae7d0cbe2d787b70d4a4611c4f1de 100644 (file)
--- a/src/rgw/rgw_rados.cc
+++ b/src/rgw/rgw_rados.cc
@@ -3923,7 +3923,7 @@ int RGWRados::Object::complete_atomic_modification()
     chain.push_obj(bucket.data_pool, key, loc);
   }
 
-  string tag = state->obj_tag.c_str();
+  string tag = (state->obj_tag.c_str() ? state->obj_tag.c_str() : "");
   int ret = store->gc->send_chain(chain, tag, false);  // do it async
 
   return ret;
@@ -4204,6 +4204,8 @@ int RGWRados::Object::Delete::delete_obj()
   if (r < 0)
     return r;
 
+  uint64_t obj_size = state->size;
+
   ObjectWriteOperation op;
 
   r = target->prepare_atomic_modification(op, false, NULL, NULL, NULL, true);
@@ -4224,9 +4226,10 @@ int RGWRados::Object::Delete::delete_obj()
 
   store->remove_rgw_head_obj(op);
   r = ref.ioctx.operate(ref.oid, &op);
+  bool need_invalidate = false;
   if (r == -ECANCELED) {
     /* raced with another operation, we can regard it as removed */
-    state->clear();
+    need_invalidate = true;
     r = 0;
   }
   bool removed = (r >= 0);
@@ -4248,16 +4251,18 @@ int RGWRados::Object::Delete::delete_obj()
     /* other than that, no need to propagate error */
   }
 
+  if (need_invalidate) {
+    target->invalidate_state();
+  }
+
   if (r < 0)
     return r;
 
   if (ret_not_existed)
     return -ENOENT;
 
-  if (state) {
-    /* update quota cache */
-    store->quota_handler->update_stats(params.bucket_owner, bucket, -1, 0, state->size);
-  }
+  /* update quota cache */
+  store->quota_handler->update_stats(params.bucket_owner, bucket, -1, 0, obj_size);
 
   return 0;
 }