diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2016-11-17 11:30:08 +0100 |
|---|---|---|
| committer | Jeff Cody <jcody@redhat.com> | 2016-11-21 17:04:43 -0500 |
| commit | 668c0e441d761a79f33eae11c120e01a29f9d4dd (patch) | |
| tree | 99cb1b5a6c2d1e01e780dfc6675bc31554550b4a /block/gluster.c | |
| parent | c36ed06e9159fa484b711dfdd27ec64d7ac3d17a (diff) | |
| download | qemu-668c0e441d761a79f33eae11c120e01a29f9d4dd.tar.gz | |
gluster: Fix use after free in glfs_clear_preopened()
This fixes a use-after-free bug introduced in commit 6349c154. We need
to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted
by Coverity.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1479378608-11962-1-git-send-email-kwolf@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
Diffstat (limited to 'block/gluster.c')
| -rw-r--r-- | block/gluster.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/block/gluster.c b/block/gluster.c index 0ce15f7adc..891c13b7ce 100644 --- a/block/gluster.c +++ b/block/gluster.c @@ -239,12 +239,13 @@ static glfs_t *glfs_find_preopened(const char *volume) static void glfs_clear_preopened(glfs_t *fs) { ListElement *entry = NULL; + ListElement *next; if (fs == NULL) { return; } - QLIST_FOREACH(entry, &glfs_list, list) { + QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) { if (entry->saved.fs == fs) { if (--entry->saved.ref) { return; |