block/qed: fix use-after-free by nullifying timer pointer after free

[PATCH] block/qed: fix use-after-free by nullifying timer pointer after free

gerben@altlinux.org posted 1 patch 11 months, 1 week ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20250304083927.37681-1-gerben@altlinux.org

Maintainers: Stefan Hajnoczi <stefanha@redhat.com>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>

block/qed.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[PATCH] block/qed: fix use-after-free by nullifying timer pointer after free

Posted by gerben@altlinux.org 11 months, 1 week ago

From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().

The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
 block/qed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/qed.c b/block/qed.c
index 382c9e5335..ac24449ffb 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -353,6 +353,7 @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
 
     qed_cancel_need_check_timer(s);
     timer_free(s->need_check_timer);
+    s->need_check_timer = NULL;
 }
 
 static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
-- 
2.42.2

Re: [PATCH] block/qed: fix use-after-free by nullifying timer pointer after free

Posted by Stefan Hajnoczi 11 months, 1 week ago

On Tue, Mar 04, 2025 at 11:39:10AM +0300, gerben@altlinux.org wrote:
> From: Denis Rastyogin <gerben@altlinux.org>
> 
> This error was discovered by fuzzing qemu-img.
> 
> In the QED block driver, the need_check_timer timer is freed in
> bdrv_qed_detach_aio_context, but the pointer to the timer is not
> set to NULL. This can lead to a use-after-free scenario
> in bdrv_qed_drain_begin().
> 
> The need_check_timer pointer is set to NULL after freeing the timer.
> Which helps catch this condition when checking in bdrv_qed_drain_begin().
> 
> Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
> Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
> ---
>  block/qed.c | 1 +
>  1 file changed, 1 insertion(+)

Thanks, applied to my block tree:
https://gitlab.com/stefanha/qemu/commits/block

Stefan