From dfe48f5fe244599b318fa128959382b3033442d6 Mon Sep 17 00:00:00 2001 From: Jeffrey Cody Date: Wed, 15 Mar 2017 18:48:39 +0100 Subject: [PATCH 02/12] gluster: Fix use after free in glfs_clear_preopened() RH-Author: Jeffrey Cody Message-id: <920c388503a9f3cf1cb1e58813b8788f1a10061d.1489603453.git.jcody@redhat.com> Patchwork-id: 74291 O-Subject: [RHEV-7.3.z qemu-kvm-rhev v2 2/2] gluster: Fix use after free in glfs_clear_preopened() Bugzilla: 1413044 RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Markus Armbruster RH-Acked-by: Miroslav Rezanina From: Kevin Wolf This fixes a use-after-free bug introduced in commit 6349c154. We need to use QLIST_FOREACH_SAFE() when freeing elements in the loop. Spotted by Coverity. Signed-off-by: Kevin Wolf Message-id: 1479378608-11962-1-git-send-email-kwolf@redhat.com Signed-off-by: Jeff Cody (cherry picked from commit 668c0e441d761a79f33eae11c120e01a29f9d4dd) Signed-off-by: Miroslav Rezanina --- block/gluster.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/gluster.c b/block/gluster.c index 0771c40..bdc4aca 100644 --- a/block/gluster.c +++ b/block/gluster.c @@ -225,12 +225,13 @@ static glfs_t *glfs_find_preopened(const char *volume) static void glfs_clear_preopened(glfs_t *fs) { ListElement *entry = NULL; + ListElement *next; if (fs == NULL) { return; } - QLIST_FOREACH(entry, &glfs_list, list) { + QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) { if (entry->saved.fs == fs) { if (--entry->saved.ref) { return; -- 1.8.3.1