On Mon, May 01, 2023 at 10:19:56AM -0400, Alexander Bulekov wrote: > A BH callback can free the BH, causing a use-after-free in aio_bh_call. > Fix that by keeping a local copy of the re-entrancy guard pointer. > > Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513 > Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API") > Signed-off-by: Alexander Bulekov <alx...@bu.edu> > --- > util/async.c | 14 ++++++++------ > 1 file changed, 8 insertions(+), 6 deletions(-)
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
signature.asc
Description: PGP signature
