netdev-linux: Fix use-after-free when netdev_dump_queues() deletes queues.

[sliver-openvswitch.git] / lib / netdev-linux.c

diff --git a/lib/netdev-linux.c b/lib/netdev-linux.c
index b287269..e9321ee 100644 (file)
--- a/lib/netdev-linux.c
+++ b/lib/netdev-linux.c
@@ -1863,7 +1863,7 @@ netdev_linux_dump_queues(const struct netdev *netdev,
 {
     struct netdev_dev_linux *netdev_dev =
                                 netdev_dev_linux_cast(netdev_get_dev(netdev));
-    struct tc_queue *queue;
+    struct tc_queue *queue, *next_queue;
     struct shash details;
     int last_error;
     int error;
@@ -1877,7 +1877,8 @@ netdev_linux_dump_queues(const struct netdev *netdev,
 
     last_error = 0;
     shash_init(&details);
-    HMAP_FOR_EACH (queue, hmap_node, &netdev_dev->tc->queues) {
+    HMAP_FOR_EACH_SAFE (queue, next_queue, hmap_node,
+                        &netdev_dev->tc->queues) {
         shash_clear(&details);
 
         error = netdev_dev->tc->ops->class_get(netdev, queue, &details);