]> git.proxmox.com Git - mirror_qemu.git/commit
coroutine: Fix use after free with qemu_coroutine_yield()
authorKevin Wolf <kwolf@redhat.com>
Tue, 10 Feb 2015 10:17:53 +0000 (11:17 +0100)
committerKevin Wolf <kwolf@redhat.com>
Mon, 9 Mar 2015 10:11:59 +0000 (11:11 +0100)
commit315a1309defd8ddf910c6c17e28cbbd7faf92f2e
tree9c43363b81766c220df0b0ad144044b3bdf2d802
parent6608c7e9eb65727524f6f590b1e716ec6e7877d4
coroutine: Fix use after free with qemu_coroutine_yield()

Instead of using the same function for entering and exiting coroutines,
and hoping that it doesn't add any functionality that hurts with the
parameters used for exiting, we can just directly call into the real
task switch in qemu_coroutine_switch().

This fixes a use-after-free scenario where reentering a coroutine that
has yielded still accesses the old parent coroutine (which may have
meanwhile terminated) in the part of coroutine_swap() that follows
qemu_coroutine_switch().

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
qemu-coroutine.c