[Qemu-devel] [PULL for-2.8 0/1] Block patches for 2.8

[Qemu-devel] [PULL for-2.8 0/1] Block patches for 2.8

[Jeff Cody]

The following changes since commit c36ed06e9159fa484b711dfdd27ec64d7ac3d17a:

  Merge remote-tracking branch 'mst/tags/for_upstream' into staging (2016-11-21 11:09:58 +0000)

are available in the git repository at:

  https://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request

for you to fetch changes up to 668c0e441d761a79f33eae11c120e01a29f9d4dd:

  gluster: Fix use after free in glfs_clear_preopened() (2016-11-21 17:04:43 -0500)

----------------------------------------------------------------
Block patches for 2.8
----------------------------------------------------------------

Kevin Wolf (1):
  gluster: Fix use after free in glfs_clear_preopened()

 block/gluster.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

-- 
2.7.4

[Qemu-devel] [PULL for-2.8 1/1] gluster: Fix use after free in glfs_clear_preopened()

[Jeff Cody]

From: Kevin Wolf <kwolf@redhat.com>

This fixes a use-after-free bug introduced in commit 6349c154. We need
to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted
by Coverity.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1479378608-11962-1-git-send-email-kwolf@redhat.com
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/gluster.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/gluster.c b/block/gluster.c
index 0ce15f7..891c13b 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -239,12 +239,13 @@ static glfs_t *glfs_find_preopened(const char *volume)
 static void glfs_clear_preopened(glfs_t *fs)
 {
     ListElement *entry = NULL;
+    ListElement *next;
 
     if (fs == NULL) {
         return;
     }
 
-    QLIST_FOREACH(entry, &glfs_list, list) {
+    QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) {
         if (entry->saved.fs == fs) {
             if (--entry->saved.ref) {
                 return;
-- 
2.7.4

Re: [Qemu-devel] [Qemu-block] [PULL for-2.8 0/1] Block patches for 2.8

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 997 bytes --]

On Mon, Nov 21, 2016 at 05:14:58PM -0500, Jeff Cody wrote:
> The following changes since commit c36ed06e9159fa484b711dfdd27ec64d7ac3d17a:
> 
>   Merge remote-tracking branch 'mst/tags/for_upstream' into staging (2016-11-21 11:09:58 +0000)
> 
> are available in the git repository at:
> 
>   https://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
> 
> for you to fetch changes up to 668c0e441d761a79f33eae11c120e01a29f9d4dd:
> 
>   gluster: Fix use after free in glfs_clear_preopened() (2016-11-21 17:04:43 -0500)
> 
> ----------------------------------------------------------------
> Block patches for 2.8
> ----------------------------------------------------------------
> 
> Kevin Wolf (1):
>   gluster: Fix use after free in glfs_clear_preopened()
> 
>  block/gluster.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> -- 
> 2.7.4
> 
> 

Thanks, applied to my staging tree:
https://github.com/stefanha/qemu/commits/staging

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]