spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

[Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

Greg Kurz posted 1 patch 8 years, 1 month ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/150524208504.32496.18214181791773634133.stgit@bahia

Test checkpatch passed

Test docker passed

Test s390x passed

hw/ppc/spapr_events.c |    4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Expand all Fold all

[Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

Posted by Greg Kurz 8 years, 1 month ago

QTAILQ_FOREACH_SAFE() must be used when removing the current element
inside the loop block.

This fixes a user-after-free error introduced by commit 56258174238eb
and reported by Coverity (CID 1381017).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/spapr_events.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 66b8164f30be..e377fc7ddea2 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr,
 
 void spapr_clear_pending_events(sPAPRMachineState *spapr)
 {
-    sPAPREventLogEntry *entry = NULL;
+    sPAPREventLogEntry *entry = NULL, *next_entry;
 
-    QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
+    QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) {
         QTAILQ_REMOVE(&spapr->pending_events, entry, next);
         g_free(entry->extended_log);
         g_free(entry);

Re: [Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

Posted by David Gibson 8 years, 1 month ago

On Tue, Sep 12, 2017 at 08:48:05PM +0200, Greg Kurz wrote:
> QTAILQ_FOREACH_SAFE() must be used when removing the current element
> inside the loop block.
> 
> This fixes a user-after-free error introduced by commit 56258174238eb
> and reported by Coverity (CID 1381017).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Applied to ppc-for-2.11.

> ---
>  hw/ppc/spapr_events.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
> index 66b8164f30be..e377fc7ddea2 100644
> --- a/hw/ppc/spapr_events.c
> +++ b/hw/ppc/spapr_events.c
> @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr,
>  
>  void spapr_clear_pending_events(sPAPRMachineState *spapr)
>  {
> -    sPAPREventLogEntry *entry = NULL;
> +    sPAPREventLogEntry *entry = NULL, *next_entry;
>  
> -    QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
> +    QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) {
>          QTAILQ_REMOVE(&spapr->pending_events, entry, next);
>          g_free(entry->extended_log);
>          g_free(entry);
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson