rgw/notifications: cache object size to avoid accessing invalid memoery

Fixes: https://tracker.ceph.com/issues/51347
Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
(cherry picked from commit fc42652ff24828d029349c2c101015d2fdb4825a)

Conflicts:
	src/rgw/rgw_op.cc

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index cd05f8ab8dbe0c039024cdaa63865a614e82d34e..bf1717781fd1a06601eb276c75cad41edc6a231a 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -5231,7 +5231,8 @@ void RGWCopyObj::execute(optional_yield y)
 
   encode_delete_at_attr(delete_at, attrs);
 
-  if (!s->system_request) { // no quota enforcement for system requests
+  uint64_t obj_size = 0;
+  {
     // get src object size (cached in obj_ctx from verify_permission())
     RGWObjState* astate = nullptr;
     op_ret = src_object->get_obj_state(this, s->obj_ctx, *src_bucket, &astate,
@@ -5239,11 +5240,15 @@ void RGWCopyObj::execute(optional_yield y)
     if (op_ret < 0) {
       return;
     }
-    // enforce quota against the destination bucket owner
-    op_ret = dest_bucket->check_quota(user_quota, bucket_quota,
+    obj_size = astate->size;
+  
+    if (!s->system_request) { // no quota enforcement for system requests
+      // enforce quota against the destination bucket owner
+      op_ret = dest_bucket->check_quota(user_quota, bucket_quota,
                                      astate->accounted_size, y);
-    if (op_ret < 0) {
-      return;
+      if (op_ret < 0) {
+        return;
+      }
     }
   }
 
@@ -5286,7 +5291,7 @@ void RGWCopyObj::execute(optional_yield y)
           s->yield);
 
   // send request to notification manager
-  const auto ret = rgw::notify::publish_commit(s->object.get(), s->obj_size, mtime, etag, event_type, res, this);
+  const auto ret = rgw::notify::publish_commit(s->object.get(), obj_size, mtime, etag, event_type, res, this);
   if (ret < 0) {
     ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret << dendl;
     // too late to rollback operation, hence op_ret is not set here