fiber: fix use-after-free on fiber destroy/recycle
When fiber region is freed/destroyed and ENABLE_BACKTRACE is set then `fiber_on_gc_truncate` callback is called. At this time both `used` argument and `fiber->gc_initial_size` are equal to 0. Thus `fiber->first_alloc_bt` is accessed which is already freed. With a bad luck freeing fiber region can put slab back into slab arena. So writing after free can change memory used by another thread. Closes #9020 NO_TEST=tested by ASAN NO_DOC=bugfix (cherry picked from commit c480a867)
Loading
Please register or sign in to comment