ucontext-cp: don't free coroutine stack and context in use
copy_file_wrapper() runs as a makecontext() coroutine on the stack
pointed to by pctx->stack_buf. On completion it freed stack_buf and
pctx, then called swapcontext(&pctx->ctx_fnew, &pctx->ctx_main). That
swap saves into and loads from the just-freed pctx while still running
on the freed stack, so the final switch back to main is a
use-after-free.
Drop the two frees from the coroutine and reclaim stack_buf and pctx
in main()'s event loop once the coroutine has finished, detected via
the completion counter. A coroutine only completes in the event loop,
since the setup loop always yields at the first await_readv.
Signed-off-by: rootvector2 <dxbnaveed.k@gmail.com>
1 file changed