[Xen-changelog] [qemu-xen master] gluster: Fix use after free in glfs_clear_preopened()

[patchbot@xxxxxxx]

commit 668c0e441d761a79f33eae11c120e01a29f9d4dd
Author:     Kevin Wolf <kwolf@xxxxxxxxxx>
AuthorDate: Thu Nov 17 11:30:08 2016 +0100
Commit:     Jeff Cody <jcody@xxxxxxxxxx>
CommitDate: Mon Nov 21 17:04:43 2016 -0500

    gluster: Fix use after free in glfs_clear_preopened()
    
    This fixes a use-after-free bug introduced in commit 6349c154. We need
    to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted
    by Coverity.
    
    Signed-off-by: Kevin Wolf <kwolf@xxxxxxxxxx>
    Message-id: 1479378608-11962-1-git-send-email-kwolf@xxxxxxxxxx
    Signed-off-by: Jeff Cody <jcody@xxxxxxxxxx>
---
 block/gluster.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/gluster.c b/block/gluster.c
index 0ce15f7..891c13b 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -239,12 +239,13 @@ static glfs_t *glfs_find_preopened(const char *volume)
 static void glfs_clear_preopened(glfs_t *fs)
 {
     ListElement *entry = NULL;
+    ListElement *next;
 
     if (fs == NULL) {
         return;
     }
 
-    QLIST_FOREACH(entry, &glfs_list, list) {
+    QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) {
         if (entry->saved.fs == fs) {
             if (--entry->saved.ref) {
                 return;
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog