diff options
| author | QingFeng Hao <haoqf@linux.vnet.ibm.com> | 2017-06-06 07:24:38 +0200 |
|---|---|---|
| committer | Juan Quintela <quintela@redhat.com> | 2017-06-07 10:20:56 +0200 |
| commit | eefff991d059d299b917627d2a95bce34d2f97f3 (patch) | |
| tree | 096d5a0b7a86de677ba3bd4bb781bbc4e9f86ad4 /migration/savevm.c | |
| parent | 53518d9448068290116bee7c3943ff6edda2b3f3 (diff) | |
qemu/migration: fix the double free problem on from_src_file
In load_snapshot, mis->from_src_file is freed twice, the first free is by
qemu_fclose, the second is by migration_incoming_state_destroy and
it causes Illegal instruction exception. The fix is just to remove the
first free.
This problem is found by qemu-iotests case 068 since commit
"660819b migration: shut src return path unconditionally". The error is:
068 1s ... - output mismatch (see 068.out.bad)
--- tests/qemu-iotests/068.out 2017-05-06 01:00:26.417270437 +0200
+++ 068.out.bad 2017-06-03 13:59:55.360274640 +0200
@@ -6,6 +6,8 @@
QEMU X.Y.Z monitor - type 'help' for more information
(qemu) savevm 0
(qemu) quit
+./common.config: line 107: 242472 Illegal instruction (core dumped) ( if [ -n "${QEMU_NEED_PID}" ]; then
+ echo $BASHPID > "${QEMU_TEST_DIR}/qemu-${_QEMU_HANDLE}.pid";
+fi; exec "$QEMU_PROG" $QEMU_OPTIONS "$@" )
QEMU X.Y.Z monitor - type 'help' for more information
-(qemu) quit
-*** done
+(qemu) *** done
Signed-off-by: QingFeng Hao <haoqf@linux.vnet.ibm.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Diffstat (limited to 'migration/savevm.c')
| -rw-r--r-- | migration/savevm.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/migration/savevm.c b/migration/savevm.c index 1993ca23fe..745caaebef 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -2276,7 +2276,6 @@ int load_snapshot(const char *name, Error **errp) aio_context_acquire(aio_context); ret = qemu_loadvm_state(f); - qemu_fclose(f); aio_context_release(aio_context); migration_incoming_state_destroy(); |