[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 10/53] snapshot: Reset err to NULL to avoid double fr
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL 10/53] snapshot: Reset err to NULL to avoid double free |
Date: |
Mon, 3 Nov 2014 11:50:13 +0000 |
From: Chris Spiegel <address@hidden>
If an error occurs in bdrv_snapshot_delete_by_id_or_name(), "err" is
freed. If "err" is not set to NULL before calling
bdrv_snapshot_delete_by_id_or_name() again, it will not be updated on
error, and will be freed again.
This can be triggered by starting a VM with at least two drives and then
attempting to delete a non-existent snapshot.
Broken in commit a89d89d.
Signed-off-by: Chris Spiegel <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
savevm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/savevm.c b/savevm.c
index 2d8eb96..08ec678 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1246,7 +1246,7 @@ int load_vmstate(const char *name)
void do_delvm(Monitor *mon, const QDict *qdict)
{
BlockDriverState *bs;
- Error *err = NULL;
+ Error *err;
const char *name = qdict_get_str(qdict, "name");
if (!find_vmstate_bs()) {
@@ -1257,6 +1257,7 @@ void do_delvm(Monitor *mon, const QDict *qdict)
bs = NULL;
while ((bs = bdrv_next(bs))) {
if (bdrv_can_snapshot(bs)) {
+ err = NULL;
bdrv_snapshot_delete_by_id_or_name(bs, name, &err);
if (err) {
monitor_printf(mon,
--
1.9.3
- [Qemu-devel] [PULL 00/53] Block patches, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 02/53] BlockLimits: introduce max_transfer_length, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 01/53] util: introduce MIN_NON_ZERO, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 03/53] block/iscsi: set max_transfer_length, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 04/53] block: avoid creating oversized writes in multiwrite_merge, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 05/53] block/iscsi: use sector_limits_lun2qemu throughout iscsi_refresh_limits, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 06/53] block/iscsi: check for oversized requests, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 07/53] ahci: Correct PIO/D2H FIS responses, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 08/53] ahci: Update byte count after DMA completion, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 09/53] ahci: Fix SDB FIS Construction, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 10/53] snapshot: Reset err to NULL to avoid double free,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL 11/53] iotests: replace fake parallels image with authentic one, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 12/53] iotests: add v2 parallels sample image and simple test for it, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 13/53] block/parallels: fix access to not initialized memory in catalog_bitmap, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 14/53] rbd: Add support for bdrv_invalidate_cache, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 15/53] block.c: Fix type of IoOperationType variable in send_qmp_error_event(), Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 17/53] block/curl: Improve type safety of s->timeout., Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 16/53] snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 18/53] raw-posix: Fix raw_co_get_block_status() after EOF, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 19/53] raw-posix: raw_co_get_block_status() return value, Stefan Hajnoczi, 2014/11/03
- [Qemu-devel] [PULL 20/53] iotests: Add test for external image truncation, Stefan Hajnoczi, 2014/11/03