diff options
| author | Max Reitz <mreitz@redhat.com> | 2013-09-25 16:37:18 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2013-09-27 11:31:59 +0200 |
| commit | 8585afd8133eed037dde9c14106e7eb8d7c46968 (patch) | |
| tree | 3fd41ce93be9bbc8e7e79c646b8ac8e6fd86ae00 | |
| parent | fd9e03e6060b3a64099d17e4a886421b21dd7341 (diff) | |
qcow2: Don't put invalid L2 table into cache
In l2_allocate, the fail path is executed if qcow2_cache_flush fails.
However, the L2 table has not yet been fetched from the L2 table cache.
The qcow2_cache_put in the fail path therefore basically gives an
undefined argument as the L2 table address (in this case).
Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| -rw-r--r-- | block/qcow2-cluster.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index ffa89411d8..153ea508bc 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -188,7 +188,7 @@ static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table) { BDRVQcowState *s = bs->opaque; uint64_t old_l2_offset; - uint64_t *l2_table; + uint64_t *l2_table = NULL; int64_t l2_offset; int ret; @@ -265,7 +265,9 @@ static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table) fail: trace_qcow2_l2_allocate_done(bs, l1_index, ret); - qcow2_cache_put(bs, s->l2_table_cache, (void**) table); + if (l2_table != NULL) { + qcow2_cache_put(bs, s->l2_table_cache, (void**) table); + } s->l1_table[l1_index] = old_l2_offset; return ret; } |