[libvirt] [PATCH] interface: fix udev backend use after free
udevIfaceListAllInterface() used the udev_device after it had its ref count decremented which results in a use after free issue. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index 92c35d9..2c41bde 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -359,7 +359,6 @@ udevIfaceListAllInterfaces(virConnectPtr conn, name = udev_device_get_sysname(dev); macaddr = udev_device_get_sysattr_value(dev, "address"); status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up"); - udev_device_unref(dev); /* Filter the results */ if (status && (flags & VIR_CONNECT_LIST_INTERFACES_ACTIVE)) @@ -375,6 +374,7 @@ udevIfaceListAllInterfaces(virConnectPtr conn, } count++; } + udev_device_unref(dev); } /* Drop our refcounts */ -- 1.7.12.4
On 02/18/13 05:28, Doug Goldstein wrote:
udevIfaceListAllInterface() used the udev_device after it had its ref count decremented which results in a use after free issue. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ACK. Peter
On Mon, Feb 18, 2013 at 2:56 AM, Peter Krempa <pkrempa@redhat.com> wrote:
On 02/18/13 05:28, Doug Goldstein wrote:
udevIfaceListAllInterface() used the udev_device after it had its ref count decremented which results in a use after free issue. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ACK.
Peter
Thanks. Pushed. -- Doug Goldstein
participants (2)
-
Doug Goldstein -
Peter Krempa