tree 72dc066a0c4d87dc647fe03b78426bc8e21de136
parent b08dc0f1b7b7b3be27ed3ffd72deeb02a1f669e7
author Alexander Bulekov <alxndr@bu.edu> 1682950796 -0400
committer Thomas Huth <thuth@redhat.com> 1683014606 +0200

async: avoid use-after-free on re-entrancy guard

A BH callback can free the BH, causing a use-after-free in aio_bh_call.
Fix that by keeping a local copy of the re-entrancy guard pointer.

Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>