From 39ba3bf69c4ef4d8a8b683ee7282efd25b3f01ff Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Fri, 15 Aug 2014 17:59:54 +0100 Subject: [PATCH] qcow2: fix new_blocks double-free in alloc_refcount_block() Commit de82815db1c89da058b7fb941dab137d6d9ab738 ("qcow2: Handle failure for potentially large allocations") introduced a double-free of new_blocks in the alloc_refcount_block() error path. The qemu-iotests qcow2 026 test case was failing because qemu-io segfaulted. Make sure new_blocks is NULL after we free it the first time. Reviewed-by: Kevin Wolf Signed-off-by: Stefan Hajnoczi --- block/qcow2-refcount.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index d60e2feb10..3b7747048e 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -381,6 +381,7 @@ static int alloc_refcount_block(BlockDriverState *bs, ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks, blocks_clusters * s->cluster_size); g_free(new_blocks); + new_blocks = NULL; if (ret < 0) { goto fail_table; } -- 2.11.0