ldomctl removes entries of a tailq while iterating without using the
_safe iteration macros.
Program received signal SIGSEGV, Segmentation fault.
0x000000ed3481d138 in guest_finalize (guest=0xef50492000) at
/usr/src/usr.sbin/ldomctl/config.c:2205
2205 if (prop->tag == MD_PROP_ARC &&
(gdb) p prop
$1 = (struct md_prop *) 0xdfdfdfdfdfdfdfdf
Program received signal SIGSEGV, Segmentation fault.
0x00000024d5b1d2e0 in guest_finalize (guest=0x27c6da5400) at
/usr/src/usr.sbin/ldomctl/config.c:2227
2227 if (prop->tag == MD_PROP_ARC &&
(gdb) p prop
$1 = (struct md_prop *) 0xdfdfdfdfdfdfdfdf
Index: config.c
===================================================================
RCS file: /cvs/src/usr.sbin/ldomctl/config.c,v
retrieving revision 1.19
diff -u -p -r1.19 config.c
--- config.c 8 May 2013 00:15:03 -0000 1.19
+++ config.c 8 Aug 2014 19:27:45 -0000
@@ -2190,7 +2190,7 @@ guest_finalize(struct guest *guest)
{
struct md *md = guest->md;
struct md_node *node, *node2;
- struct md_prop *prop;
+ struct md_prop *prop, *prop2;
struct mblock *mblock;
struct md_node *parent;
struct md_node *child;
@@ -2201,7 +2201,7 @@ guest_finalize(struct guest *guest)
char *path;
node = md_find_node(md, "cpus");
- TAILQ_FOREACH(prop, &node->prop_list, link) {
+ TAILQ_FOREACH_SAFE(prop, &node->prop_list, link, prop2) {
if (prop->tag == MD_PROP_ARC &&
strcmp(prop->name->str, "fwd") == 0) {
node2 = prop->d.arc.node;
@@ -2223,7 +2223,7 @@ guest_finalize(struct guest *guest)
* able to configure crypto work queues.
*/
node = md_find_node(md, "virtual-devices");
- TAILQ_FOREACH(prop, &node->prop_list, link) {
+ TAILQ_FOREACH_SAFE(prop, &node->prop_list, link, prop2) {
if (prop->tag == MD_PROP_ARC &&
strcmp(prop->name->str, "fwd") == 0) {
node2 = prop->d.arc.node;
