Re: [Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 1362 bytes --]

On Tue, Sep 12, 2017 at 08:48:05PM +0200, Greg Kurz wrote:
> QTAILQ_FOREACH_SAFE() must be used when removing the current element
> inside the loop block.
> 
> This fixes a user-after-free error introduced by commit 56258174238eb
> and reported by Coverity (CID 1381017).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Applied to ppc-for-2.11.

> ---
>  hw/ppc/spapr_events.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
> index 66b8164f30be..e377fc7ddea2 100644
> --- a/hw/ppc/spapr_events.c
> +++ b/hw/ppc/spapr_events.c
> @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr,
>  
>  void spapr_clear_pending_events(sPAPRMachineState *spapr)
>  {
> -    sPAPREventLogEntry *entry = NULL;
> +    sPAPREventLogEntry *entry = NULL, *next_entry;
>  
> -    QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
> +    QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) {
>          QTAILQ_REMOVE(&spapr->pending_events, entry, next);
>          g_free(entry->extended_log);
>          g_free(entry);
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]