aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2012-04-18 16:18:14 +0200
committerKevin Wolf <kwolf@redhat.com>2012-04-19 16:03:27 +0200
commit8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74 (patch)
treecb346bf3bedf39c1ad707a13e34da40f831a7569
parente82dabd82e7a8ce0294bce829b3d2dd25eb3a514 (diff)
downloadqemu-8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74.zip
qemu-8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74.tar.gz
qemu-8dc0a5e7a06c059683f9c379c0a4b0bbc20d5c74.tar.bz2
qcow2: Fix error handling in qcow2_alloc_cluster_offset
If do_alloc_cluster_offset() fails, the error handling code tried to remove the request from the in-flight queue, to which it wasn't added yet, resulting in a NULL pointer dereference. m->nb_clusters really only becomes != 0 when the request is in the list. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-rw-r--r--block/qcow2-cluster.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index cbd224d..dcf70a2 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -931,7 +931,7 @@ again:
fail:
qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
fail_put:
- if (nb_clusters > 0) {
+ if (m->nb_clusters > 0) {
QLIST_REMOVE(m, next_in_flight);
}
return ret;