tarantool / tarantool / 5977889672

88%

push

github

fiber: fix use-after-free on fiber destroy/recycle

When fiber region is freed/destroyed and ENABLE_BACKTRACE is set then
`fiber_on_gc_truncate` callback is called. At this time both `used`
argument and `fiber->gc_initial_size` are equal to 0. Thus
`fiber->first_alloc_bt` is accessed which is already freed.

With a bad luck freeing fiber region can put slab back into slab arena.
So writing after free can change memory used by another thread.

Closes #9020

NO_TEST=tested by ASAN
NO_DOC=bugfix

64040 of 115674 branches covered (0.0%)

2 of 2 new or added lines in 1 file covered. (100.0%)

95873 of 111037 relevant lines covered (86.34%)

2629383.16 hits per line