From: Matt Benjamin <mbenjamin@redhat.com>
Date: Tue, 12 May 2026 16:48:43 +0000 (-0400)
Subject: rgwlc: fix a likely null dereference in LCObjsLister::get_obj()
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=b2f5d1876ef9e30449f8d95df8fe0b6fd277f01c;p=ceph.git

rgwlc: fix a likely null dereference in LCObjsLister::get_obj()

Found by Opus 4.6:

  In get_obj() (lines 417-446), when obj_iter ==
  list_results.objs.end() and the listing is truncated, the code calls
  fetch() to get the next batch. fetch() sets obj_iter =
  list_results.objs.begin(). But if the new fetch returns zero objects
  (possible if objects were deleted between listing batches, or due to
  filtering/race conditions), then begin() == end() and the code falls
  through to line 437:

  if (obj_iter->key.name == pre_obj.key.name) {

  This dereferences end() — undefined behavior / crash. The
  return-value check at line 445 (return obj_iter !=
  list_results.objs.end()) comes too late; the dereference already
  happened.

Fixes: https://tracker.ceph.com/issues/76790

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
Assisted-by: Claude Code, Opus 4.6 1M
---

diff --git a/src/rgw/rgw_lc.cc b/src/rgw/rgw_lc.cc
index fdfbbc5abf2..53ad1326c7a 100644
--- a/src/rgw/rgw_lc.cc
+++ b/src/rgw/rgw_lc.cc
@@ -527,6 +527,9 @@ public:
         }
       }
       delay(dpp);
+      if (obj_iter == list_results.objs.end()) {
+        return false;
+      }
     }
 
     if (obj_iter->key.name == pre_obj.key.name) {
@@ -537,7 +540,7 @@ public:
 
     /* returning address of entry in objs */
     *obj = &(*obj_iter);
-    return obj_iter != list_results.objs.end();
+    return true;
   }
 
   rgw_bucket_dir_entry get_prev_obj() {