diff options
| author | Denis Rastyogin <gerben@altlinux.org> | 2025-03-04 11:39:10 +0300 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2025-03-06 10:19:54 +0800 |
| commit | 2ad638a3d160923ef3dbf87c73944e6e44bdc724 (patch) | |
| tree | 625884a4a7d10eec4e95bcfa1fa3b7b7a57287f7 | |
| parent | 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56 (diff) | |
| download | focaccia-qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.tar.gz focaccia-qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.zip | |
block/qed: fix use-after-free by nullifying timer pointer after free
This error was discovered by fuzzing qemu-img. In the QED block driver, the need_check_timer timer is freed in bdrv_qed_detach_aio_context, but the pointer to the timer is not set to NULL. This can lead to a use-after-free scenario in bdrv_qed_drain_begin(). The need_check_timer pointer is set to NULL after freeing the timer. Which helps catch this condition when checking in bdrv_qed_drain_begin(). Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852 Signed-off-by: Denis Rastyogin <gerben@altlinux.org> Message-ID: <20250304083927.37681-1-gerben@altlinux.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| -rw-r--r-- | block/qed.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/qed.c b/block/qed.c index 382c9e5335..ac24449ffb 100644 --- a/block/qed.c +++ b/block/qed.c @@ -353,6 +353,7 @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs) qed_cancel_need_check_timer(s); timer_free(s->need_check_timer); + s->need_check_timer = NULL; } static void bdrv_qed_attach_aio_context(BlockDriverState *bs, |