From: Denis Rastyogin <ger...@altlinux.org> This error was discovered by fuzzing qemu-img.
In the QED block driver, the need_check_timer timer is freed in bdrv_qed_detach_aio_context, but the pointer to the timer is not set to NULL. This can lead to a use-after-free scenario in bdrv_qed_drain_begin(). The need_check_timer pointer is set to NULL after freeing the timer. Which helps catch this condition when checking in bdrv_qed_drain_begin(). Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852 Signed-off-by: Denis Rastyogin <ger...@altlinux.org> Message-ID: <20250304083927.37681-1-ger...@altlinux.org> Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> (cherry picked from commit 2ad638a3d160923ef3dbf87c73944e6e44bdc724) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> diff --git a/block/qed.c b/block/qed.c index 2f36ad342c..1ebb00fe04 100644 --- a/block/qed.c +++ b/block/qed.c @@ -340,6 +340,7 @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs) qed_cancel_need_check_timer(s); timer_free(s->need_check_timer); + s->need_check_timer = NULL; } static void bdrv_qed_attach_aio_context(BlockDriverState *bs, -- 2.39.5
