From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51649) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VOqDd-0000gi-5q for qemu-devel@nongnu.org; Wed, 25 Sep 2013 10:37:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VOqDV-0007wZ-Hq for qemu-devel@nongnu.org; Wed, 25 Sep 2013 10:37:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15229) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VOqDV-0007wU-B0 for qemu-devel@nongnu.org; Wed, 25 Sep 2013 10:37:25 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r8PEbOjA020658 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 25 Sep 2013 10:37:24 -0400 From: Max Reitz Date: Wed, 25 Sep 2013 16:37:18 +0200 Message-Id: <1380119840-12672-2-git-send-email-mreitz@redhat.com> In-Reply-To: <1380119840-12672-1-git-send-email-mreitz@redhat.com> References: <1380119840-12672-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH 1/3] qcow2: Don't put invalid L2 table into cache List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi , Max Reitz In l2_allocate, the fail path is executed if qcow2_cache_flush fails. However, the L2 table has not yet been fetched from the L2 table cache. The qcow2_cache_put in the fail path therefore basically gives an undefined argument as the L2 table address (in this case). Signed-off-by: Max Reitz --- block/qcow2-cluster.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 738ff73..f6d47c9 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -188,7 +188,7 @@ static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table) { BDRVQcowState *s = bs->opaque; uint64_t old_l2_offset; - uint64_t *l2_table; + uint64_t *l2_table = NULL; int64_t l2_offset; int ret; @@ -265,7 +265,9 @@ static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table) fail: trace_qcow2_l2_allocate_done(bs, l1_index, ret); - qcow2_cache_put(bs, s->l2_table_cache, (void**) table); + if (l2_table != NULL) { + qcow2_cache_put(bs, s->l2_table_cache, (void**) table); + } s->l1_table[l1_index] = old_l2_offset; return ret; } -- 1.8.3.1