motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-12-29 02:30:29 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

block/qed: fix use-after-free by nullifying timer pointer after free

Browse source 
This error was discovered by fuzzing qemu-img.

In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().

The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 2ad638a3d1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Denis Rastyogin 2025-03-04 11:39:10 +03:00 • committed by Michael Tokarev
parent 57bc5203dd
commit 9f1e501fb1
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
block/qed.c
View file

@ -353,6 +353,7 @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
qed_cancel_need_check_timer(s);
timer_free(s->need_check_timer);
s->need_check_timer = NULL;
}
static void bdrv_qed_attach_aio_context(BlockDriverState *bs,