Commit d492a75c authored by Greg Kurz's avatar Greg Kurz Committed by David Gibson
Browse files

spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events() 



QTAILQ_FOREACH_SAFE() must be used when removing the current element
inside the loop block.

This fixes a user-after-free error introduced by commit 56258174
and reported by Coverity (CID 1381017).

Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
Signed-off-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
parent 3b2fcedd

hw/ppc/spapr_events.c

+2 −2
Original line number Diff line number Diff line
@@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, 


void spapr_clear_pending_events(sPAPRMachineState *spapr)

{

    sPAPREventLogEntry *entry = NULL;

    sPAPREventLogEntry *entry = NULL, *next_entry;



    QTAILQ_FOREACH(entry, &spapr->pending_events, next) {

    QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) {

        QTAILQ_REMOVE(&spapr->pending_events, entry, next);

        g_free(entry->extended_log);

        g_free(entry);