From: Kevin Wolf Date: Tue, 10 Feb 2015 10:17:53 +0000 (+0100) Subject: coroutine: Fix use after free with qemu_coroutine_yield() X-Git-Tag: qemu-xen-4.6.0-rc1~34^2~2 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=07db6859abffa79db6290a5f9f4dfdf93148189f;p=qemu-upstream-unstable.git coroutine: Fix use after free with qemu_coroutine_yield() Instead of using the same function for entering and exiting coroutines, and hoping that it doesn't add any functionality that hurts with the parameters used for exiting, we can just directly call into the real task switch in qemu_coroutine_switch(). This fixes a use-after-free scenario where reentering a coroutine that has yielded still accesses the old parent coroutine (which may have meanwhile terminated) in the part of coroutine_swap() that follows qemu_coroutine_switch(). Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf Reviewed-by: Paolo Bonzini (cherry picked from commit 80687b4dd6f43b3fef61fef8fbcb358457350562) Signed-off-by: Michael Roth --- diff --git a/qemu-coroutine.c b/qemu-coroutine.c index bd574aa1b..0101855e6 100644 --- a/qemu-coroutine.c +++ b/qemu-coroutine.c @@ -135,7 +135,7 @@ void coroutine_fn qemu_coroutine_yield(void) } self->caller = NULL; - coroutine_swap(self, to); + qemu_coroutine_switch(self, to, COROUTINE_YIELD); } void qemu_coroutine_adjust_pool_size(int n)