diff options
| author | Chris Spiegel <chris.spiegel@cypherpath.com> | 2014-10-06 09:33:45 -0700 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2014-11-03 09:48:41 +0000 |
| commit | ba2b22888c43fdf36f3ae0553c89013616e9c44a (patch) | |
| tree | 26339a068f56bc5e24fbd3b66f314295270a9f4a | |
| parent | 54a7f8f38ddf4711ee8bf773b5066337b045a343 (diff) | |
| download | qemu-ba2b22888c43fdf36f3ae0553c89013616e9c44a.zip | |
snapshot: Reset err to NULL to avoid double free
If an error occurs in bdrv_snapshot_delete_by_id_or_name(), "err" is
freed. If "err" is not set to NULL before calling
bdrv_snapshot_delete_by_id_or_name() again, it will not be updated on
error, and will be freed again.
This can be triggered by starting a VM with at least two drives and then
attempting to delete a non-existent snapshot.
Broken in commit a89d89d.
Signed-off-by: Chris Spiegel <chris.spiegel@cypherpath.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1412613225-32676-1-git-send-email-chris.spiegel@cypherpath.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| -rw-r--r-- | savevm.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -1246,7 +1246,7 @@ int load_vmstate(const char *name) void do_delvm(Monitor *mon, const QDict *qdict) { BlockDriverState *bs; - Error *err = NULL; + Error *err; const char *name = qdict_get_str(qdict, "name"); if (!find_vmstate_bs()) { @@ -1257,6 +1257,7 @@ void do_delvm(Monitor *mon, const QDict *qdict) bs = NULL; while ((bs = bdrv_next(bs))) { if (bdrv_can_snapshot(bs)) { + err = NULL; bdrv_snapshot_delete_by_id_or_name(bs, name, &err); if (err) { monitor_printf(mon, |