diff options
| author | Denis Rastyogin <gerben@altlinux.org> | 2025-03-04 11:39:10 +0300 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2025-03-06 10:19:54 +0800 |
| commit | 2ad638a3d160923ef3dbf87c73944e6e44bdc724 (patch) | |
| tree | 625884a4a7d10eec4e95bcfa1fa3b7b7a57287f7 /hw/core/sysbus.c | |
| parent | 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56 (diff) | |
| download | focaccia-qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.tar.gz focaccia-qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.zip | |
block/qed: fix use-after-free by nullifying timer pointer after free
This error was discovered by fuzzing qemu-img. In the QED block driver, the need_check_timer timer is freed in bdrv_qed_detach_aio_context, but the pointer to the timer is not set to NULL. This can lead to a use-after-free scenario in bdrv_qed_drain_begin(). The need_check_timer pointer is set to NULL after freeing the timer. Which helps catch this condition when checking in bdrv_qed_drain_begin(). Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852 Signed-off-by: Denis Rastyogin <gerben@altlinux.org> Message-ID: <20250304083927.37681-1-gerben@altlinux.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/core/sysbus.c')
0 files changed, 0 insertions, 0 deletions