mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gluster: Fix use after free in glfs_clear_preopened()

Browse Source 
This fixes a use-after-free bug introduced in commit 6349c154. We need
to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted
by Coverity.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1479378608-11962-1-git-send-email-kwolf@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
This commit is contained in:
Kevin Wolf 2016-11-17 11:30:08 +01:00 committed by Jeff Cody
parent c36ed06e91
commit 668c0e441d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
block/gluster.c
View File

@ -239,12 +239,13 @@ static glfs_t *glfs_find_preopened(const char *volume)
static void glfs_clear_preopened(glfs_t *fs)
{
ListElement *entry = NULL;
ListElement *next;
if (fs == NULL) {
return;
}
QLIST_FOREACH(entry, &glfs_list, list) {
QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) {
if (entry->saved.fs == fs) {
if (--entry->saved.ref) {
return;