common/async: fix stack-use-after-scope in co_waiter#67568
common/async: fix stack-use-after-scope in co_waiter#67568
Conversation
|
@cbody Hey Casey, could you help review this change? I created a tracker ticket to track this bug, as this issue triggers during shutdown/cancellation scenarios when:
this happens in production. |
|
jenkins test make check arm64 |
When co_waiter is destroyed, the cancellation slot may still hold a reference to the op_cancellation callback which captures 'this'. If the cancellation signal is emitted after co_waiter is destroyed (e.g., during co_throttle shutdown), it results in a stack-use-after-scope error. Fix by adding a destructor that retrieves the cancellation slot from the handler (if still active) and clears it before destruction. This ensures the cancellation callback is removed before the co_waiter object goes out of scope, preventing use-after-scope errors. The cancellation slot cannot be stored as a member variable because it becomes invalid after the handler is moved out in complete(). Instead, we retrieve it on demand from the handler in the destructor, which is the only place we need it. Signed-off-by: Kefu Chai <k.chai@proxmox.com>
8571adb to
b760a94
Compare
|
jenkins test make check arm64 |
|
@cbodley Hi Casey, thank you for reviewing and approving this change. If I want to add some QA coverage for it, do you have a recommendation for which RGW suite would be the most appropriate to run? My current thought is that, for minimal RGW-specific coverage, |
|
thanks @tchaikov, sorry for the delay. i've started qa in https://pulpito.ceph.com/cbodley-2026-03-19_17:12:17-rgw-wip-cbodley-testing-distro-default-trial/ |
When co_waiter is destroyed, the cancellation slot may still hold a reference to the op_cancellation callback which captures 'this'. If the cancellation signal is emitted after co_waiter is destroyed (e.g., during co_throttle shutdown), it results in a stack-use-after-scope error.
Fix by adding a destructor that retrieves the cancellation slot from the handler (if still active) and clears it before destruction. This ensures the cancellation callback is removed before the co_waiter object goes out of scope, preventing use-after-scope errors.
The cancellation slot cannot be stored as a member variable because it becomes invalid after the handler is moved out in complete(). Instead, we retrieve it on demand from the handler in the destructor, which is
the only place we need it.
This issue was identified by ASan:
Fixes: https://tracker.ceph.com/issues/75231
Contribution Guidelines
To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an
xbetween the brackets:[x]. Spaces and capitalization matter when checking off items this way.Checklist
Show available Jenkins commands
jenkins test classic perfJenkins Job | Jenkins Job Definitionjenkins test crimson perfJenkins Job | Jenkins Job Definitionjenkins test signedJenkins Job | Jenkins Job Definitionjenkins test make checkJenkins Job | Jenkins Job Definitionjenkins test make check arm64Jenkins Job | Jenkins Job Definitionjenkins test submodulesJenkins Job | Jenkins Job Definitionjenkins test dashboardJenkins Job | Jenkins Job Definitionjenkins test dashboard cephadmJenkins Job | Jenkins Job Definitionjenkins test apiJenkins Job | Jenkins Job Definitionjenkins test docsReadTheDocs | Github Workflow Definitionjenkins test ceph-volume allJenkins Jobs | Jenkins Jobs Definitionjenkins test windowsJenkins Job | Jenkins Job Definitionjenkins test rook e2eJenkins Job | Jenkins Job DefinitionYou must only issue one Jenkins command per-comment. Jenkins does not understand
comments with more than one command.