From cdbddaffa624e7c6e2b094e6f1c51cbb63e8eae6 Mon Sep 17 00:00:00 2001
From: Florian Fischer <florian.fischer@muhq.space>
Date: Sat, 26 Feb 2022 12:52:14 +0100
Subject: [PATCH] fix lockless io-stealing

The uninitialized continuation pointer may be returned without being
written resulting in dispatching a not valid fiber pointer.

If a CQE is stolen but no fiber is blocked on the corresponding future
IoContext::getContinuationsFromCompletions will call future->completeAndGetContinuation
which will set the future's completion but will not return a continuation.

If no continuation is returned from Future::completeAndGetContinuation
the continuation buffer is not advanced by IoContext::getContinuationsFromCompletions
(emper/io/IoContext.hpp:259).

IoContext::reapSingleCompletion does not check if a continuation was
created and assumed that continuation contains a valid Fiber* if
a CQE was successfully stolen.

Initialize continuation with nullptr, which is a valid Fiber*.
---
 emper/io/IoContext.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/emper/io/IoContext.hpp b/emper/io/IoContext.hpp
index 2a0ba954..67ee0e99 100644
--- a/emper/io/IoContext.hpp
+++ b/emper/io/IoContext.hpp
@@ -476,7 +476,7 @@ class IoContext : public Logger<LogSubsystem::IO> {
 	 */
 	template <CallerEnvironment callerEnvironment>
 	[[nodiscard]] auto reapSingleCompletion() -> Fiber * {
-		Fiber *fiber;
+		Fiber *fiber = nullptr;
 
 		if constexpr (emper::WAITFREE_IO_STEALING) {
 			auto res = tryReapCompletionWaitFree<callerEnvironment>(&fiber);
-- 
GitLab