From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37424) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XlGAc-00047T-59 for qemu-devel@nongnu.org; Mon, 03 Nov 2014 06:51:43 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XlGAX-00009Y-2N for qemu-devel@nongnu.org; Mon, 03 Nov 2014 06:51:38 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50332) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XlGAW-00009M-RR for qemu-devel@nongnu.org; Mon, 03 Nov 2014 06:51:32 -0500 From: Stefan Hajnoczi Date: Mon, 3 Nov 2014 11:50:13 +0000 Message-Id: <1415015456-25086-11-git-send-email-stefanha@redhat.com> In-Reply-To: <1415015456-25086-1-git-send-email-stefanha@redhat.com> References: <1415015456-25086-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL 10/53] snapshot: Reset err to NULL to avoid double free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Chris Spiegel From: Chris Spiegel If an error occurs in bdrv_snapshot_delete_by_id_or_name(), "err" is freed. If "err" is not set to NULL before calling bdrv_snapshot_delete_by_id_or_name() again, it will not be updated on error, and will be freed again. This can be triggered by starting a VM with at least two drives and then attempting to delete a non-existent snapshot. Broken in commit a89d89d. Signed-off-by: Chris Spiegel Reviewed-by: Markus Armbruster Message-id: 1412613225-32676-1-git-send-email-chris.spiegel@cypherpath.com Signed-off-by: Stefan Hajnoczi --- savevm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/savevm.c b/savevm.c index 2d8eb96..08ec678 100644 --- a/savevm.c +++ b/savevm.c @@ -1246,7 +1246,7 @@ int load_vmstate(const char *name) void do_delvm(Monitor *mon, const QDict *qdict) { BlockDriverState *bs; - Error *err = NULL; + Error *err; const char *name = qdict_get_str(qdict, "name"); if (!find_vmstate_bs()) { @@ -1257,6 +1257,7 @@ void do_delvm(Monitor *mon, const QDict *qdict) bs = NULL; while ((bs = bdrv_next(bs))) { if (bdrv_can_snapshot(bs)) { + err = NULL; bdrv_snapshot_delete_by_id_or_name(bs, name, &err); if (err) { monitor_printf(mon, -- 1.9.3