udevIfaceListAllInterface() used the udev_device after it had its ref
count decremented which results in a use after free issue.
---
src/interface/interface_backend_udev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/interface/interface_backend_udev.c
b/src/interface/interface_backend_udev.c
index 92c35d9..2c41bde 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -359,7 +359,6 @@ udevIfaceListAllInterfaces(virConnectPtr conn,
name = udev_device_get_sysname(dev);
macaddr = udev_device_get_sysattr_value(dev, "address");
status = STREQ(udev_device_get_sysattr_value(dev, "operstate"),
"up");
- udev_device_unref(dev);
/* Filter the results */
if (status && (flags & VIR_CONNECT_LIST_INTERFACES_ACTIVE))
@@ -375,6 +374,7 @@ udevIfaceListAllInterfaces(virConnectPtr conn,
}
count++;
}
+ udev_device_unref(dev);
}
/* Drop our refcounts */
--
1.7.12.4