On Wed, Sep 16, 2026 at 06:18:26PM +0200, Tommaso Califano wrote: > In QEMU's USB MTP (Media Transfer Protocol) device emulation, the > usb_mtp_deletefn() > function in hw/usb/dev-mtp.c iterates over a child object list using > QLIST_FOREACH > while the recursive call may free the current element. After the free, the > macro reads > the le_next field from freed memory to advance the iterator. > > Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer > before the > iteration body executes. > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991 > Signed-off-by: Tommaso Califano <[email protected]> > --- > hw/usb/dev-mtp.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-)
Reviewed-by: Daniel P. Berrangé <[email protected]> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
