From: Yuval Lifshitz <ylifshit@redhat.com>
Date: Fri, 2 Jul 2021 13:12:33 +0000 (+0300)
Subject: rgw/notifications: cache object size to avoid accessing invalid memoery
X-Git-Tag: v17.1.0~1471^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=fc42652ff24828d029349c2c101015d2fdb4825a;p=ceph-ci.git

rgw/notifications: cache object size to avoid accessing invalid memoery

Fixes: https://tracker.ceph.com/issues/51347

Signed-off-by: Yuval Lifshitz <ylifshit@redhat.com>
---

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index e89ae9732e2..167ad3593e4 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -5270,20 +5270,25 @@ void RGWCopyObj::execute(optional_yield y)
 
   encode_delete_at_attr(delete_at, attrs);
 
-  // get src object size (cached in obj_ctx from verify_permission())
-  RGWObjState* astate = nullptr;
-  op_ret = src_object->get_obj_state(this, s->obj_ctx, &astate, s->yield, true);
-  if (op_ret < 0) {
-    return;
-  }
 
-  if (!s->system_request) { // no quota enforcement for system requests
-    // enforce quota against the destination bucket owner
-    op_ret = dest_bucket->check_quota(this, user_quota, bucket_quota,
-				      astate->accounted_size, y);
+  uint64_t obj_size = 0;
+  {
+    // get src object size (cached in obj_ctx from verify_permission())
+    RGWObjState* astate = nullptr;
+    op_ret = src_object->get_obj_state(this, s->obj_ctx, &astate, s->yield, true);
     if (op_ret < 0) {
       return;
     }
+    obj_size = astate->size;
+  
+    if (!s->system_request) { // no quota enforcement for system requests
+      // enforce quota against the destination bucket owner
+      op_ret = dest_bucket->check_quota(this, user_quota, bucket_quota,
+				      astate->accounted_size, y);
+      if (op_ret < 0) {
+        return;
+      }
+    }
   }
 
   bool high_precision_time = (s->system_request);
@@ -5325,7 +5330,7 @@ void RGWCopyObj::execute(optional_yield y)
 	   s->yield);
 
   // send request to notification manager
-  int ret = res->publish_commit(this, astate->size, mtime, etag, dest_object->get_instance());
+  int ret = res->publish_commit(this, obj_size, mtime, etag, dest_object->get_instance());
   if (ret < 0) {
     ldpp_dout(this, 1) << "ERROR: publishing notification failed, with error: " << ret << dendl;
     // too late to rollback operation, hence op_ret is not set here