diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2012-04-18 16:18:14 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2012-04-19 16:03:27 +0200 |
| commit | 8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74 (patch) | |
| tree | cb346bf3bedf39c1ad707a13e34da40f831a7569 /block | |
| parent | e82dabd82e7a8ce0294bce829b3d2dd25eb3a514 (diff) | |
| download | qemu-8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74.zip | |
qcow2: Fix error handling in qcow2_alloc_cluster_offset
If do_alloc_cluster_offset() fails, the error handling code tried to
remove the request from the in-flight queue, to which it wasn't added
yet, resulting in a NULL pointer dereference.
m->nb_clusters really only becomes != 0 when the request is in the list.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/qcow2-cluster.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index cbd224dc46..dcf70a24d3 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -931,7 +931,7 @@ again: fail: qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); fail_put: - if (nb_clusters > 0) { + if (m->nb_clusters > 0) { QLIST_REMOVE(m, next_in_flight); } return ret; |