From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58367) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YL8GC-0003I3-ES for qemu-devel@nongnu.org; Tue, 10 Feb 2015 05:41:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YL8GB-0001Rx-JO for qemu-devel@nongnu.org; Tue, 10 Feb 2015 05:41:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35072) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YL8GB-0001R7-Ct for qemu-devel@nongnu.org; Tue, 10 Feb 2015 05:41:39 -0500 From: Kevin Wolf Date: Tue, 10 Feb 2015 11:41:26 +0100 Message-Id: <1423564888-14933-2-git-send-email-kwolf@redhat.com> In-Reply-To: <1423564888-14933-1-git-send-email-kwolf@redhat.com> References: <1423564888-14933-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 1/3] coroutine: Fix use after free with qemu_coroutine_yield() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, pbonzini@redhat.com, famz@redhat.com, wu.wubin@huawei.com, stefanha@redhat.com Instead of using the same function for entering and exiting coroutines, and hoping that it doesn't add any functionality that hurts with the parameters used for exiting, we can just directly call into the real task switch in qemu_coroutine_switch(). This fixes a use-after-free scenario where reentering a coroutine that has yielded still accesses the old parent coroutine (which may have meanwhile terminated) in the part of coroutine_swap() that follows qemu_coroutine_switch(). Signed-off-by: Kevin Wolf --- qemu-coroutine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu-coroutine.c b/qemu-coroutine.c index 525247b..5019b81 100644 --- a/qemu-coroutine.c +++ b/qemu-coroutine.c @@ -148,5 +148,5 @@ void coroutine_fn qemu_coroutine_yield(void) } self->caller = NULL; - coroutine_swap(self, to); + qemu_coroutine_switch(self, to, COROUTINE_YIELD); } -- 1.8.3.1