tarantool / tarantool / 5977901146

86%

master: 88%

push

github

fiber: fix use-after-free on fiber destroy/recycle

When fiber region is freed/destroyed and ENABLE_BACKTRACE is set then
`fiber_on_gc_truncate` callback is called. At this time both `used`
argument and `fiber->gc_initial_size` are equal to 0. Thus
`fiber->first_alloc_bt` is accessed which is already freed.

With a bad luck freeing fiber region can put slab back into slab arena.
So writing after free can change memory used by another thread.

Closes #9020

NO_TEST=tested by ASAN
NO_DOC=bugfix

(cherry picked from commit c480a8676)

62379 of 114202 branches covered (0.0%)

2 of 2 new or added lines in 1 file covered. (100.0%)

93361 of 108722 relevant lines covered (85.87%)

2641312.53 hits per line