diff mbox series

[Stable-9.2.3,28/51] block/qed: fix use-after-free by nullifying timer pointer after free

Message ID 20250315061801.622606-28-mjt@tls.msk.ru (mailing list archive)
State New
Headers show
Series Patch Round-up for stable 9.2.3, freeze on 2025-03-24 | expand

Commit Message

Michael Tokarev March 15, 2025, 6:17 a.m. UTC 
From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().

The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 2ad638a3d160923ef3dbf87c73944e6e44bdc724)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff mbox series

Patch

diff --git a/block/qed.c b/block/qed.c
index fa5bc11085..f321126241 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -353,6 +353,7 @@  static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
 
     qed_cancel_need_check_timer(s);
     timer_free(s->need_check_timer);
+    s->need_check_timer = NULL;
 }
 
 static void bdrv_qed_attach_aio_context(BlockDriverState *bs,