From d492a75cfefd9a09125ba2b007c817c1417c3820 Mon Sep 17 00:00:00 2001 From: Greg Kurz Date: Tue, 12 Sep 2017 20:48:05 +0200 Subject: [PATCH] spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events() QTAILQ_FOREACH_SAFE() must be used when removing the current element inside the loop block. This fixes a user-after-free error introduced by commit 56258174238eb and reported by Coverity (CID 1381017). Signed-off-by: Greg Kurz Signed-off-by: David Gibson --- hw/ppc/spapr_events.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c index 66b8164f30..e377fc7dde 100644 --- a/hw/ppc/spapr_events.c +++ b/hw/ppc/spapr_events.c @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, void spapr_clear_pending_events(sPAPRMachineState *spapr) { - sPAPREventLogEntry *entry = NULL; + sPAPREventLogEntry *entry = NULL, *next_entry; - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { QTAILQ_REMOVE(&spapr->pending_events, entry, next); g_free(entry->extended_log); g_free(entry);