Re: [PATCH] hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration

["Daniel P. Berrangé" <berrange@redhat.com>]

On Wed, Sep 16, 2026 at 06:18:26PM +0200, Tommaso Califano wrote:
> In QEMU's USB MTP (Media Transfer Protocol) device emulation, the usb_mtp_deletefn()
> function in hw/usb/dev-mtp.c iterates over a child object list using QLIST_FOREACH
> while the recursive call may free the current element. After the free, the macro reads
> the le_next field from freed memory to advance the iterator.
> 
> Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer before the
> iteration body executes.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991
> Signed-off-by: Tommaso Califano <tcalifan@redhat.com>
> ---
>  hw/usb/dev-mtp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|