[Qemu-devel] [PATCH 0/2] Fix some coverity reported defects

[Qemu-devel] [PATCH 0/2] Fix some coverity reported defects

[Bandan Das]

The first change replaces QLIST_FOREACH with the safe variant
and the second was incorrectly using MTPObject * in the trace function
after freeing it.

Bandan Das (2):
  usb-mtp: use safe variant when cleaning events list
  usb-mtp: fix call to trace function

 hw/usb/dev-mtp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.6.2

[Qemu-devel] [PATCH 1/2] usb-mtp: use safe variant when cleaning events list

[Bandan Das]

usb_mtp_inotify_cleanup uses QLIST_FOREACH to pick events
from a list and free them which is incorrect. Use QLIST_FOREACH_SAFE
instead.

Signed-off-by: Bandan Das <bsd@redhat.com>
---
 hw/usb/dev-mtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index af056c7..db1fd59 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -556,7 +556,7 @@ static int usb_mtp_inotify_init(MTPState *s)
 
 static void usb_mtp_inotify_cleanup(MTPState *s)
 {
-    MTPMonEntry *e;
+    MTPMonEntry *e, *p;
 
     if (!s->inotifyfd) {
         return;
@@ -565,7 +565,7 @@ static void usb_mtp_inotify_cleanup(MTPState *s)
     qemu_set_fd_handler(s->inotifyfd, NULL, NULL, s);
     close(s->inotifyfd);
 
-    QTAILQ_FOREACH(e, &s->events, next) {
+    QTAILQ_FOREACH_SAFE(e, &s->events, next, p) {
         QTAILQ_REMOVE(&s->events, e, next);
         g_free(e);
     }
-- 
2.6.2

[Qemu-devel] [PATCH 2/2] usb-mtp: fix call to trace function

[Bandan Das]

trace_usb_mtp_inotify_event() was being called after the object was
being freed.

Signed-off-by: Bandan Das <bsd@redhat.com>
---
 hw/usb/dev-mtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index db1fd59..4177a87 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -502,9 +502,9 @@ static void inotify_watchfn(void *arg)
                 entry = g_new0(MTPMonEntry, 1);
                 entry->handle = o->handle;
                 entry->event = EVT_OBJ_REMOVED;
-                usb_mtp_object_free(s, o);
                 trace_usb_mtp_inotify_event(s->dev.addr, o->path,
                                       event->mask, "Obj Deleted");
+                usb_mtp_object_free(s, o);
                 break;
 
             case IN_MODIFY:
-- 
2.6.2

Re: [Qemu-devel] [PATCH 0/2] Fix some coverity reported defects

[Gerd Hoffmann]

On Mi, 2015-12-23 at 14:39 +0530, Bandan Das wrote:
> The first change replaces QLIST_FOREACH with the safe variant
> and the second was incorrectly using MTPObject * in the trace function
> after freeing it.
> 
> Bandan Das (2):
>   usb-mtp: use safe variant when cleaning events list
>   usb-mtp: fix call to trace function
> 
>  hw/usb/dev-mtp.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 

Added to usb patch queue.

thanks,
  Gerd