On Wed, Sep 16, 2026 at 06:18:26PM +0200, Tommaso Califano wrote:
> In QEMU's USB MTP (Media Transfer Protocol) device emulation, the 
> usb_mtp_deletefn()
> function in hw/usb/dev-mtp.c iterates over a child object list using 
> QLIST_FOREACH
> while the recursive call may free the current element. After the free, the 
> macro reads
> the le_next field from freed memory to advance the iterator.
> 
> Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer 
> before the
> iteration body executes.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991
> Signed-off-by: Tommaso Califano <[email protected]>
> ---
>  hw/usb/dev-mtp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Daniel P. Berrangé <[email protected]>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|


Reply via email to