Skip to content

fix: used to use after free when starting non-joinable fiber which immediately exits

Georgy Moshkin requested to merge gmoshkin/fix-use-after-free-the-easy-way into master

Summary

  • fix: bump sub-crate dependency versions

  • fix: used to use after free when starting non-joinable fiber which immediately exits

The problem was that the fiber function (trampoline_for_ffi) would always free the Context when before exiting, but we access this context from the parent fiber to get the fiber's id. This isn't a problem in most cases because usually fiber's yield at least once before exiting in which case the parent fiber would be accessing the still live Context. But in a rare case that the fiber exits before yielding the Context would be freed before the parent accesses it.

The simple solution is to use Rc instead of Box so that the lifetime of Context is managed automatically for us. Unfortunately we also have to wrap the Context in an UnsafeCell so that we're able to mutate it without undefined behavior.

There's actually now some places where we implicitly treat *mut UnsafeCell<Context> as *mut Context which is completely safe as UnsafeCell is #[transparent].

Ensure that

  • New code is covered by tests
  • API is documented
  • Changelog is up to date
  • Version is bumped in the appropriate Cargo.toml files

Merge request reports