From: Casey Bodley <cbodley@redhat.com>
Date: Fri, 7 Sep 2018 21:01:25 +0000 (-0400)
Subject: rgw: dont access rgw_http_req_data::client of canceled request
X-Git-Tag: v14.0.1~179^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=cdc876a3c5e3e8874c633b9355dfea51c1ee3bdf;p=ceph.git

rgw: dont access rgw_http_req_data::client of canceled request

if a request has been canceled with RGWHTTPClient::cancel(), the client
may have been destroyed. check req_data->registered before reading
from req_data->client->receive_pause_skip

Fixes: http://tracker.ceph.com/issues/35851

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---

diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index 0002e5054548e..b2adae8d1c574 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -292,13 +292,6 @@ size_t RGWHTTPClient::receive_http_data(void * const ptr,
 
   bool pause = false;
 
-  size_t& skip_bytes = req_data->client->receive_pause_skip;
-
-  if (skip_bytes >= len) {
-    skip_bytes -= len;
-    return len;
-  }
-
   RGWHTTPClient *client;
 
   {
@@ -310,6 +303,13 @@ size_t RGWHTTPClient::receive_http_data(void * const ptr,
     client = req_data->client;
   }
 
+  size_t& skip_bytes = client->receive_pause_skip;
+
+  if (skip_bytes >= len) {
+    skip_bytes -= len;
+    return len;
+  }
+
   int ret = client->receive_data((char *)ptr + skip_bytes, len - skip_bytes, &pause);
   if (ret < 0) {
     dout(0) << "WARNING: client->receive_data() returned ret=" << ret << dendl;