From patchwork Tue Sep 12 18:48:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kurz X-Patchwork-Id: 813010 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3xsDN16hnnz9s7g for ; Wed, 13 Sep 2017 04:48:45 +1000 (AEST) Received: from localhost ([::1]:38129 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1drqEk-0004Ml-G3 for incoming@patchwork.ozlabs.org; Tue, 12 Sep 2017 14:48:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58770) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1drqER-0004MW-1n for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1drqEN-0005hE-UO for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:23 -0400 Received: from 3.mo2.mail-out.ovh.net ([46.105.58.226]:41048) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1drqEN-0005gr-O6 for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:19 -0400 Received: from player770.ha.ovh.net (b6.ovh.net [213.186.33.56]) by mo2.mail-out.ovh.net (Postfix) with ESMTP id D2245AB4D1 for ; Tue, 12 Sep 2017 20:48:17 +0200 (CEST) Received: from [192.168.0.243] (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player770.ha.ovh.net (Postfix) with ESMTPA id 687783C0072; Tue, 12 Sep 2017 20:48:12 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 12 Sep 2017 20:48:05 +0200 Message-ID: <150524208504.32496.18214181791773634133.stgit@bahia> User-Agent: StGit/0.17.1-46-g6855-dirty MIME-Version: 1.0 X-Ovh-Tracer-Id: 3166312017149466897 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelledrgedvgdduvdefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 46.105.58.226 Subject: [Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Daniel Henrique Barboza , qemu-ppc@nongnu.org, David Gibson Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" QTAILQ_FOREACH_SAFE() must be used when removing the current element inside the loop block. This fixes a user-after-free error introduced by commit 56258174238eb and reported by Coverity (CID 1381017). Signed-off-by: Greg Kurz --- hw/ppc/spapr_events.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c index 66b8164f30be..e377fc7ddea2 100644 --- a/hw/ppc/spapr_events.c +++ b/hw/ppc/spapr_events.c @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, void spapr_clear_pending_events(sPAPRMachineState *spapr) { - sPAPREventLogEntry *entry = NULL; + sPAPREventLogEntry *entry = NULL, *next_entry; - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { QTAILQ_REMOVE(&spapr->pending_events, entry, next); g_free(entry->extended_log); g_free(entry);