]> xenbits.xensource.com Git - qemu-upstream-4.6-testing.git/commit
coroutine: Fix use after free with qemu_coroutine_yield()
authorKevin Wolf <kwolf@redhat.com>
Tue, 10 Feb 2015 10:17:53 +0000 (11:17 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Mon, 9 Mar 2015 03:58:14 +0000 (22:58 -0500)
commit07db6859abffa79db6290a5f9f4dfdf93148189f
tree43e8a7c009237539e82c2a0bb00234e0dc0cc4cf
parentc4ca8af86deca543a1e19aac4cbaec052a3ea455
coroutine: Fix use after free with qemu_coroutine_yield()

Instead of using the same function for entering and exiting coroutines,
and hoping that it doesn't add any functionality that hurts with the
parameters used for exiting, we can just directly call into the real
task switch in qemu_coroutine_switch().

This fixes a use-after-free scenario where reentering a coroutine that
has yielded still accesses the old parent coroutine (which may have
meanwhile terminated) in the part of coroutine_swap() that follows
qemu_coroutine_switch().

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 80687b4dd6f43b3fef61fef8fbcb358457350562)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qemu-coroutine.c