From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38179) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WOvcl-0001PP-6m for qemu-devel@nongnu.org; Sat, 15 Mar 2014 16:56:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WOvcf-0005ZV-7W for qemu-devel@nongnu.org; Sat, 15 Mar 2014 16:56:07 -0400 Received: from mx1.redhat.com ([209.132.183.28]:5370) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WOvce-0005ZA-W1 for qemu-devel@nongnu.org; Sat, 15 Mar 2014 16:56:01 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s2FKtxFq000991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sat, 15 Mar 2014 16:55:59 -0400 From: Max Reitz Date: Sat, 15 Mar 2014 21:55:54 +0100 Message-Id: <1394916954-21774-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Laszlo Ersek , Stefan Hajnoczi , Max Reitz If qcow2_alloc_clusters() fails, new_offset and ret will both be negative after the fail label, thus passing the first if condition and subsequently resulting in a call of qcow2_free_clusters() with an invalid (negative) offset parameter. Fix this by checking for new_offset being positive instead. While we're at it, clean up the whole fail path. qcow2_cache_put() actually can never fail, hence the return value can safely be ignored (aside from asserting that it indeed did not fail). Furthermore, there is no reason to give QCOW2_DISCARD_ALWAYS to qcow2_free_clusters(), a mere QCOW2_DISCARD_OTHER will suffice. Signed-off-by: Max Reitz Suggested-by: Laszlo Ersek --- block/qcow2-refcount.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 6151148..b111319 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -1440,20 +1440,22 @@ static int64_t realloc_refcount_block(BlockDriverState *bs, int reftable_index, } fail: - if (new_offset && (ret < 0)) { - qcow2_free_clusters(bs, new_offset, s->cluster_size, - QCOW2_DISCARD_ALWAYS); - } if (refcount_block) { - if (ret < 0) { - qcow2_cache_put(bs, s->refcount_block_cache, &refcount_block); - } else { - ret = qcow2_cache_put(bs, s->refcount_block_cache, &refcount_block); - } + /* This should never fail, as it would only do so if the given refcount + * block cannot be found in the cache. As this is impossible as long as + * there are no bugs, assert the success. */ + int tmp = qcow2_cache_put(bs, s->refcount_block_cache, &refcount_block); + assert(tmp == 0); } + if (ret < 0) { + if (new_offset > 0) { + qcow2_free_clusters(bs, new_offset, s->cluster_size, + QCOW2_DISCARD_OTHER); + } return ret; } + return new_offset; } -- 1.9.0