From 7b6c1eb6db8911935889ba19b00a116a7066c58f Mon Sep 17 00:00:00 2001
From: wokron <yi1tang.yang@gmail.com>
Date: Thu, 27 Aug 2026 22:30:54 +0800
Subject: [PATCH] fix deadlock caused by CancelRequest

---
 include/condy/detail/runtime.hpp | 22 ----------------------
 include/condy/runtime.hpp        | 18 ++++--------------
 2 files changed, 4 insertions(+), 36 deletions(-)

diff --git a/include/condy/detail/runtime.hpp b/include/condy/detail/runtime.hpp
index 5d0ee388..8351b18a 100644
--- a/include/condy/detail/runtime.hpp
+++ b/include/condy/detail/runtime.hpp
@@ -59,28 +59,6 @@ inline int sync_msg_ring(io_uring_sqe *sqe_data) noexcept {
 #endif
 }
 
-class CancelRequest {
-public:
-    CancelRequest(uintptr_t data) : data_(data) {}
-
-    void wait() noexcept {
-        while (!finished_.load(std::memory_order_acquire)) {
-            finished_.wait(false, std::memory_order_relaxed);
-        }
-    }
-
-    void notify() noexcept {
-        finished_.store(true, std::memory_order_release);
-        finished_.notify_one();
-    }
-
-    uintptr_t data() const noexcept { return data_; }
-
-private:
-    uintptr_t data_;
-    std::atomic_bool finished_ = false;
-};
-
 class OpFinishHandleBase {
 public:
     using HandleFunc = bool (*)(void *, io_uring_cqe *) noexcept;
diff --git a/include/condy/runtime.hpp b/include/condy/runtime.hpp
index db20affd..af20965f 100644
--- a/include/condy/runtime.hpp
+++ b/include/condy/runtime.hpp
@@ -91,19 +91,13 @@ class Runtime {
             return;
         }
 
-        detail::CancelRequest request(data);
-        detail::tsan_release(&request);
-        schedule_msg_ring_(
-            curr_runtime,
-            detail::encode_work(&request, detail::WorkType::Cancel));
+        // Potential address reuse problem?
+        schedule_msg_ring_(curr_runtime, detail::encode_work_ptr(
+                                             data, detail::WorkType::Cancel));
         if (curr_runtime != nullptr) {
             // Ensure the cancel msg is submitted.
             curr_runtime->ring_.submit();
         }
-        // Block until the runtime thread has submitted the cancel SQE. This is
-        // important to prevent address reuse of the same data pointer, which
-        // can lead to incorrect cancellation or other bugs.
-        request.wait();
     }
 
     void pend_work_internal() noexcept {
@@ -403,12 +397,8 @@ class Runtime {
                 (*work)();
             }
         } else if (type == detail::WorkType::Cancel) {
-            detail::CancelRequest *request =
-                static_cast<detail::CancelRequest *>(data);
-            detail::tsan_acquire(request);
             io_uring_sqe *sqe = ring_.get_sqe();
-            prep_cancel_(sqe, request->data());
-            request->notify();
+            prep_cancel_(sqe, reinterpret_cast<uintptr_t>(data));
         } else if (type == detail::WorkType::Common) {
             auto *handle = static_cast<detail::OpFinishHandleBase *>(data);
             auto op_finish = handle->handle(cqe);