Alexander Bulekov f88ebe0c7d async: avoid use-after-free on re-entrancy guard ...

A BH callback can free the BH, causing a use-after-free in aio_bh_call.
Fix that by keeping a local copy of the re-entrancy guard pointer.

Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 7915bd06f25e1803778081161bf6fa10c42dc7cd)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

2023-09-11 10:53:50 +03:00

..

aio-posix.c

…

aio-posix.h

…

aio-wait.c

…

aio-win32.c

…

aiocb.c

…

async-teardown.c

…

async.c

async: avoid use-after-free on re-entrancy guard

2023-09-11 10:53:50 +03:00

atomic64.c

…

base64.c

…

bitmap.c

…

bitops.c

…

block-helpers.c

…

block-helpers.h

…

buffer.c

…

bufferiszero.c

…

cacheflush.c

…

compatfd.c

…

coroutine-sigaltstack.c

…

coroutine-ucontext.c

…

coroutine-win32.c

…

crc32c.c

…

crc-ccitt.c

…

cutils.c

…

dbus.c

…

drm.c

…

envlist.c

…

error-report.c

…

error.c

…

event_notifier-posix.c

…

event_notifier-win32.c

…

fdmon-epoll.c

…

fdmon-io_uring.c

…

fdmon-poll.c

…

fifo8.c

…

filemonitor-inotify.c

…

filemonitor-stub.c

…

getauxval.c

…

guest-random.c

…

hbitmap.c

…

hexdump.c

…

host-utils.c

…

id.c

…

int128.c

…

iov.c

…

iova-tree.c

…

keyval.c

…

lockcnt.c

…

log.c

…

main-loop.c

…

memalign.c

…

memfd.c

…

meson.build

…

mmap-alloc.c

…

module.c

…

notify.c

…

nvdimm-utils.c

…

osdep.c

…

oslib-posix.c

…

oslib-win32.c

…

path.c

…

qdist.c

…

qemu-co-shared-resource.c

…

qemu-co-timeout.c

…

qemu-config.c

…

qemu-coroutine-io.c

…

qemu-coroutine-lock.c

…

qemu-coroutine-sleep.c

…

qemu-coroutine.c

…

qemu-option.c

…

qemu-print.c

…

qemu-progress.c

…

qemu-sockets.c

…

qemu-thread-common.h

…

qemu-thread-posix.c

…

qemu-thread-win32.c

…

qemu-timer-common.c

…

qemu-timer.c

…

qht.c

…

qsp.c

…

range.c

…

rcu.c

…

readline.c

…

selfmap.c

…

stats64.c

…

sys_membarrier.c

…

systemd.c

…

thread-context.c

…

thread-pool.c

…

throttle.c

…

timed-average.c

…

trace-events

…

trace.h

…

transactions.c

…

unicode.c

…

uri.c

…

userfaultfd.c

…

uuid.c

…

vfio-helpers.c

…

vhost-user-server.c

…

yank.c

…