Fix ABA and UAF problem in ConditionVariable notify operation using internal spinlock (#458) (#459)

* Fix ABA problem in ConditionVariable::notifyOne using internal spinlock (Fixes #458)

* Fix UAF and ABA in ConditionVariable notify using SpinLock (Fixes #458)

Serialize notifyOne and notifyAll with an internal SpinLock (MPSC model) to prevent Use-After-Free and ABA memory corruption during concurrent pops, while preserving the lock-free performance of wait().

* fix(ci): resolve clang-format warnings and C++20 module dependency

* style: bypass clang-format for module dependency order

Author: fanfanffy163

async_simple/async_simple.cppm

@@ -58,8 +58,10 @@ export extern "C++" {
   #include "uthread/internal/thread.h"
   #include "uthread/Uthread.h"
   #include "uthread/Async.h"
-  #include "coro/ConditionVariable.h"
+  // clang-format off
   #include "coro/SpinLock.h"
+  #include "coro/ConditionVariable.h"
+  // clang-format on
   #include "coro/Latch.h"
   #include "coro/CountEvent.h"
   #include "coro/Collect.h"

async_simple/coro/ConditionVariable.h

@@ -19,6 +19,7 @@
 #ifndef ASYNC_SIMPLE_USE_MODULES
 #include <mutex>
 #include "async_simple/coro/Lazy.h"
+#include "async_simple/coro/SpinLock.h"
 
 #endif  // ASYNC_SIMPLE_USE_MODULES
 
@@ -50,6 +51,7 @@ class ConditionVariable {
 private:
     friend class ConditionVariableAwaiter<Lock>;
     std::atomic<ConditionVariableAwaiter<Lock>*> _awaiters = nullptr;
+    SpinLock _notifyLock;
 };
 
 template <class Lock>
@@ -94,21 +96,31 @@ inline Lazy<> ConditionVariable<Lock>::wait(Lock& lock, Pred&& pred) noexcept {
 
 template <class Lock>
 inline void ConditionVariable<Lock>::notifyAll() noexcept {
-    auto awaitings = _awaiters.load(std::memory_order_acquire);
-    while (!_awaiters.compare_exchange_weak(awaitings, nullptr,
-                                            std::memory_order_acq_rel,
-                                            std::memory_order_acquire))
-        ;
+    ConditionVariableAwaiter<Lock>* awaitings = nullptr;
+    {
+        ScopedSpinLock notifyLock(_notifyLock);
+        awaitings = _awaiters.load(std::memory_order_acquire);
+        while (!_awaiters.compare_exchange_weak(awaitings, nullptr,
+                                                std::memory_order_acq_rel,
+                                                std::memory_order_acquire))
+            ;
+    }
     resumeWaiters(awaitings);
 }
 
 template <class Lock>
 inline void ConditionVariable<Lock>::notifyOne() noexcept {
-    auto awaitings = _awaiters.load(std::memory_order_acquire);
-    while (awaitings && !_awaiters.compare_exchange_weak(awaitings, awaitings->_next,
-                                            std::memory_order_acq_rel,
-                                            std::memory_order_acquire))
-        ;
+    ConditionVariableAwaiter<Lock>* awaitings = nullptr;
+    {
+        ScopedSpinLock notifyLock(_notifyLock);
+        awaitings = _awaiters.load(std::memory_order_acquire);
+        while (awaitings &&
+               !_awaiters.compare_exchange_weak(awaitings, awaitings->_next,
+                                                std::memory_order_acq_rel,
+                                                std::memory_order_acquire))
+            ;
+    }
+
     if (!awaitings) {
         return;
     }