| Message ID | 150524208504.32496.18214181791773634133.stgit@bahia |
|---|---|
| State | New |
| Headers | show |
| Series | spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events() | expand |
On Tue, Sep 12, 2017 at 08:48:05PM +0200, Greg Kurz wrote: > QTAILQ_FOREACH_SAFE() must be used when removing the current element > inside the loop block. > > This fixes a user-after-free error introduced by commit 56258174238eb > and reported by Coverity (CID 1381017). > > Signed-off-by: Greg Kurz <groug@kaod.org> Applied to ppc-for-2.11. > --- > hw/ppc/spapr_events.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c > index 66b8164f30be..e377fc7ddea2 100644 > --- a/hw/ppc/spapr_events.c > +++ b/hw/ppc/spapr_events.c > @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, > > void spapr_clear_pending_events(sPAPRMachineState *spapr) > { > - sPAPREventLogEntry *entry = NULL; > + sPAPREventLogEntry *entry = NULL, *next_entry; > > - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { > + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { > QTAILQ_REMOVE(&spapr->pending_events, entry, next); > g_free(entry->extended_log); > g_free(entry); >
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c index 66b8164f30be..e377fc7ddea2 100644 --- a/hw/ppc/spapr_events.c +++ b/hw/ppc/spapr_events.c @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, void spapr_clear_pending_events(sPAPRMachineState *spapr) { - sPAPREventLogEntry *entry = NULL; + sPAPREventLogEntry *entry = NULL, *next_entry; - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { QTAILQ_REMOVE(&spapr->pending_events, entry, next); g_free(entry->extended_log); g_free(entry);
QTAILQ_FOREACH_SAFE() must be used when removing the current element inside the loop block. This fixes a user-after-free error introduced by commit 56258174238eb and reported by Coverity (CID 1381017). Signed-off-by: Greg Kurz <groug@kaod.org> --- hw/ppc/spapr_events.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)