From: Doug Goldstein <cardoe@cardoe.com>
Date: Mon, 18 Feb 2013 04:26:38 +0000 (-0600)
Subject: interface: fix udev backend use after free
X-Git-Tag: v1.0.3-rc1~94
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5eb621fcb3d46fecf114b3afdb7f0bc478f708a9;p=thirdparty%2Flibvirt.git

interface: fix udev backend use after free

udevIfaceListAllInterface() used the udev_device after it had its ref
count decremented which results in a use after free issue.
---

diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
index 92c35d9202..2c41bde814 100644
--- a/src/interface/interface_backend_udev.c
+++ b/src/interface/interface_backend_udev.c
@@ -359,7 +359,6 @@ udevIfaceListAllInterfaces(virConnectPtr conn,
         name = udev_device_get_sysname(dev);
         macaddr = udev_device_get_sysattr_value(dev, "address");
         status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
-        udev_device_unref(dev);
 
         /* Filter the results */
         if (status && (flags & VIR_CONNECT_LIST_INTERFACES_ACTIVE))
@@ -375,6 +374,7 @@ udevIfaceListAllInterfaces(virConnectPtr conn,
             }
             count++;
         }
+        udev_device_unref(dev);
     }
 
     /* Drop our refcounts */