From nobody Tue Nov 4 00:12:18 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1505242156689925.041835950246; Tue, 12 Sep 2017 11:49:16 -0700 (PDT) Received: from localhost ([::1]:38130 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1drqFH-0004jZ-IA for importer@patchew.org; Tue, 12 Sep 2017 14:49:15 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58770) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1drqER-0004MW-1n for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1drqEN-0005hE-UO for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:23 -0400 Received: from 3.mo2.mail-out.ovh.net ([46.105.58.226]:41048) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1drqEN-0005gr-O6 for qemu-devel@nongnu.org; Tue, 12 Sep 2017 14:48:19 -0400 Received: from player770.ha.ovh.net (b6.ovh.net [213.186.33.56]) by mo2.mail-out.ovh.net (Postfix) with ESMTP id D2245AB4D1 for ; Tue, 12 Sep 2017 20:48:17 +0200 (CEST) Received: from [192.168.0.243] (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player770.ha.ovh.net (Postfix) with ESMTPA id 687783C0072; Tue, 12 Sep 2017 20:48:12 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 12 Sep 2017 20:48:05 +0200 Message-ID: <150524208504.32496.18214181791773634133.stgit@bahia> User-Agent: StGit/0.17.1-46-g6855-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 3166312017149466897 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelledrgedvgdduvdefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 46.105.58.226 Subject: [Qemu-devel] [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Daniel Henrique Barboza , qemu-ppc@nongnu.org, David Gibson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 QTAILQ_FOREACH_SAFE() must be used when removing the current element inside the loop block. This fixes a user-after-free error introduced by commit 56258174238eb and reported by Coverity (CID 1381017). Signed-off-by: Greg Kurz --- hw/ppc/spapr_events.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c index 66b8164f30be..e377fc7ddea2 100644 --- a/hw/ppc/spapr_events.c +++ b/hw/ppc/spapr_events.c @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineSta= te *spapr, =20 void spapr_clear_pending_events(sPAPRMachineState *spapr) { - sPAPREventLogEntry *entry =3D NULL; + sPAPREventLogEntry *entry =3D NULL, *next_entry; =20 - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { QTAILQ_REMOVE(&spapr->pending_events, entry, next); g_free(entry->extended_log); g_free(entry);