[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL for-2.8 1/1] gluster: Fix use after free in glfs_clea
From: |
Jeff Cody |
Subject: |
[Qemu-devel] [PULL for-2.8 1/1] gluster: Fix use after free in glfs_clear_preopened() |
Date: |
Mon, 21 Nov 2016 17:14:59 -0500 |
From: Kevin Wolf <address@hidden>
This fixes a use-after-free bug introduced in commit 6349c154. We need
to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted
by Coverity.
Signed-off-by: Kevin Wolf <address@hidden>
Message-id: address@hidden
Reviewed-by: Jeff Cody <address@hidden>
Signed-off-by: Jeff Cody <address@hidden>
---
block/gluster.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/gluster.c b/block/gluster.c
index 0ce15f7..891c13b 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -239,12 +239,13 @@ static glfs_t *glfs_find_preopened(const char *volume)
static void glfs_clear_preopened(glfs_t *fs)
{
ListElement *entry = NULL;
+ ListElement *next;
if (fs == NULL) {
return;
}
- QLIST_FOREACH(entry, &glfs_list, list) {
+ QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) {
if (entry->saved.fs == fs) {
if (--entry->saved.ref) {
return;
--
2.7.4