From: Adam C. Emerson <aemerson@redhat.com>
Date: Tue, 24 Jan 2023 03:50:58 +0000 (-0500)
Subject: common/async: Don't get allocator from moved-from handler
X-Git-Tag: v19.3.0~349^2~34
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=bf8447afda47745c89e7ba1291a556e1734cab28;p=ceph.git

common/async: Don't get allocator from moved-from handler

In the `destroy_` functions of `CompletionImpl` we were getting the
associated allocator after moving out of the handler into the call to
`bind_and_forward`. This was triggering a crash on null-pointer access
in operations made with `co_composed`.

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---

diff --git a/src/common/async/completion.h b/src/common/async/completion.h
index 384c85f0fe38..a7dd7370f024 100644
--- a/src/common/async/completion.h
+++ b/src/common/async/completion.h
@@ -189,24 +189,24 @@ class CompletionImpl final : public Completion<void(Args...), T> {
 
   void destroy_defer(std::tuple<Args...>&& args) override {
     auto w = std::move(work);
-    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindAlloc2 alloc2 = boost::asio::get_associated_allocator(handler);
+    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindTraits2::destroy(alloc2, this);
     RebindTraits2::deallocate(alloc2, this, 1);
     w.second.get_executor().defer(std::move(f), alloc2);
   }
   void destroy_dispatch(std::tuple<Args...>&& args) override {
     auto w = std::move(work);
-    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindAlloc2 alloc2 = boost::asio::get_associated_allocator(handler);
+    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindTraits2::destroy(alloc2, this);
     RebindTraits2::deallocate(alloc2, this, 1);
     w.second.get_executor().dispatch(std::move(f), alloc2);
   }
   void destroy_post(std::tuple<Args...>&& args) override {
     auto w = std::move(work);
-    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindAlloc2 alloc2 = boost::asio::get_associated_allocator(handler);
+    auto f = bind_and_forward(std::move(handler), std::move(args));
     RebindTraits2::destroy(alloc2, this);
     RebindTraits2::deallocate(alloc2, this, 1);
     w.second.get_executor().post(std::move(f), alloc2);