From 4155c998b6f7618aad0e67c34c2a4aea841114cf Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 22 Apr 2020 15:07:18 +0200 Subject: qga: Fix qmp_guest_get_memory_blocks() error handling The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. qmp_guest_get_memory_blocks() passes &local_err to transfer_memory_block() in a loop. If this fails in more than one iteration, it can trip error_setv()'s assertion. Fix it to break the loop. Cc: Michael Roth Signed-off-by: Markus Armbruster Message-Id: <20200422130719.28225-14-armbru@redhat.com> Reviewed-by: Eric Blake --- qga/commands-posix.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'qga') diff --git a/qga/commands-posix.c b/qga/commands-posix.c index a52af03..ae1348d 100644 --- a/qga/commands-posix.c +++ b/qga/commands-posix.c @@ -2518,6 +2518,9 @@ GuestMemoryBlockList *qmp_guest_get_memory_blocks(Error **errp) mem_blk->phys_index = strtoul(&de->d_name[6], NULL, 10); mem_blk->has_can_offline = true; /* lolspeak ftw */ transfer_memory_block(mem_blk, true, NULL, &local_err); + if (local_err) { + break; + } entry = g_malloc0(sizeof *entry); entry->value = mem_blk; -- cgit v1.1