From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mark McLoughlin <markmc@redhat.com>
Subject: Re: [PATCH 2/4] [v2] kvm: qemu: Fix leak of ioperm data
Date: Wed, 10 Dec 2008 13:25:46 +0000
Message-ID: <1228915546.5384.47.camel@blaa>
References: <715D42877B251141A38726ABF5CABF2C018BF9AD47@pdsmsx503.ccr.corp.intel.com>
Reply-To: Mark McLoughlin <markmc@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Cc: "'Avi Kivity'" <avi@redhat.com>,
	"'kvm@vger.kernel.org'" <kvm@vger.kernel.org>
To: "Han, Weidong" <weidong.han@intel.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx2.redhat.com ([66.187.237.31]:54852 "EHLO mx2.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1752879AbYLJN1M (ORCPT <rfc822;kvm@vger.kernel.org>);
	Wed, 10 Dec 2008 08:27:12 -0500
In-Reply-To: <715D42877B251141A38726ABF5CABF2C018BF9AD47@pdsmsx503.ccr.corp.intel.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Wed, 2008-12-10 at 21:22 +0800, Han, Weidong wrote:
> 
> +void kvm_remove_ioperm_data(unsigned long start_port, unsigned long num)
> +{
> +    struct ioperm_data *data;
> +
> +    data = LIST_FIRST(&ioperm_head);
> +    while (data) {
> +        if (data->start_port == start_port && data->num == num) {
> +            LIST_REMOVE(data, entries);
> +            qemu_free(data);
> +        }
> +
> +        data = LIST_NEXT(data, entries);
> +    }
> +}

Repeating what I said last time:

     You've a "use after free bug" here; you free the structure and
     LIST_NEXT de-references the pointer to it in order to obtain the
     pointer to the next structure.

What you need is:

{
    struct ioperm_data *data;

    data = LIST_FIRST(&ioperm_head);
    while (data) {
        struct ioperm_data *next = LIST_NEXT(data, entries);

        if (data->start_port == start_port && data->num == num) {
            LIST_REMOVE(data, entries);
            qemu_free(data);
        }

        data = next;
    }
}

Cheers,
Mark.