The coroutine implementation uses __thread variables internally. Compiler optimizations may cache Thread-Local Storage values across qemu_coroutine_yield(), leading to stale values being used after the coroutine is re-entered from another thread.
Kevin pointed out that the coroutine implementation itself is vulnerable to this problem. As a follow-up to my coroutine TLS patch series I'm sending these patches to convert __thread variables to the new "qemu/coroutine-tls.h" macros so they are safe. Stefan Hajnoczi (3): coroutine-ucontext: use QEMU_DEFINE_STATIC_CO_TLS() coroutine: use QEMU_DEFINE_STATIC_CO_TLS() coroutine-win32: use QEMU_DEFINE_STATIC_CO_TLS() util/coroutine-ucontext.c | 38 +++++++++++++++++++++++------------- util/coroutine-win32.c | 18 ++++++++++++----- util/qemu-coroutine.c | 41 +++++++++++++++++++++++---------------- 3 files changed, 61 insertions(+), 36 deletions(-) -- 2.35.1
