]> git.apps.os.sepia.ceph.com Git - ceph.git/commitdiff
common/async:: Update delete operator in CompletionImpl for improved memory management 64969/head
authorEdwin Rodriguez <edwin.rodriguez1@ibm.com>
Tue, 5 Aug 2025 12:56:46 +0000 (08:56 -0400)
committerEdwin Rodriguez <edwin.rodriguez1@ibm.com>
Wed, 20 Aug 2025 12:36:01 +0000 (08:36 -0400)
Fix UB in CompletionImpl 'operator delete' to eliminate uninitialized memory access

Fixes: https://tracker.ceph.com/issues/72478
Signed-off-by: Edwin Rodriguez <edwin.rodriguez1@ibm.com>
src/common/async/completion.h

index 6cdfaaa63b730a7de32da4228037cfb7233e5d85..a8d0aa847ba6285078c78689bd736580d3b7071f 100644 (file)
@@ -246,8 +246,17 @@ class CompletionImpl final : public Completion<void(Args...), T> {
                                            std::forward<TArgs>(args)...)};
   }
 
-  static void operator delete(void *p) {
-    static_cast<CompletionImpl*>(p)->destroy();
+  // C++20 destroying delete.
+  // When this overload is selected by `delete ptr`, the compiler does NOT call
+  // ~CompletionImpl(). We must do the full teardown here. We route through
+  // destroy() so that:
+  //  - the completion’s custom lifecycle (defer/dispatch/post) is honored,
+  //  - the object’s destructor is invoked, and
+  //  - deallocation is performed using the matching allocator (RebindAlloc2).
+  // Keep this function noexcept; destroy() is responsible for both destruction
+  // and allocator-aware deallocation.
+  static void operator delete(CompletionImpl* ptr, std::destroying_delete_t) noexcept {
+    ptr->destroy();
   }
 };