diff options
| author | Denis Rastyogin <gerben@altlinux.org> | 2025-03-04 11:39:10 +0300 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2025-03-06 10:19:54 +0800 |
| commit | 2ad638a3d160923ef3dbf87c73944e6e44bdc724 (patch) | |
| tree | 625884a4a7d10eec4e95bcfa1fa3b7b7a57287f7 /rust/qemu-api/src | |
| parent | 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56 (diff) | |
| download | qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.zip qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.tar.gz qemu-2ad638a3d160923ef3dbf87c73944e6e44bdc724.tar.bz2 | |
block/qed: fix use-after-free by nullifying timer pointer after free
This error was discovered by fuzzing qemu-img.
In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().
The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'rust/qemu-api/src')
0 files changed, 0 insertions, 0 deletions