Commit 99a9614c79 for qemu.org

commit 99a9614c790b2774a1397a68d41b6a4efc90a2f3
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:29 2026 +0400

    ui/console: use QLIST_FOREACH_SAFE in dpy_refresh

    A display listener's dpy_refresh callback could potentially unregister
    itself from the listener list, which would invalidate the iteration
    pointer. Switch to QLIST_FOREACH_SAFE to allow safe removal during
    traversal.

    Reported-by: Hui Peng <benquike@gmail.com>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-15-ccbef537cbeb@redhat.com>

diff --git a/ui/console.c b/ui/console.c
index 795c9857de..b735717200 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -828,9 +828,9 @@ bool qemu_console_check_format(QemuConsole *con,

 static void dpy_refresh(DisplayState *s)
 {
-    DisplayChangeListener *dcl;
+    DisplayChangeListener *dcl, *next_dcl;

-    QLIST_FOREACH(dcl, &s->listeners, next) {
+    QLIST_FOREACH_SAFE(dcl, &s->listeners, next, next_dcl) {
         if (dcl->ops->dpy_refresh) {
             dcl->ops->dpy_refresh(dcl);
         }