diff mbox

[v2] rbd: avoid qemu_rbd_snap_list() memory leaks

Message ID 1380117648-17625-1-git-send-email-stefanha@redhat.com
State New
Headers show

Commit Message

Stefan Hajnoczi Sept. 25, 2013, 2 p.m. UTC 
When there are no snapshots qemu_rbd_snap_list() returns 0 and the
snapshot table pointer is NULL.  Don't forget to free the snaps buffer
we allocated for librbd rbd_snap_list().

When the function succeeds don't forget to free the snaps buffer after
calling rbd_snap_list_end().

Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/rbd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Kevin Wolf Sept. 25, 2013, 2:23 p.m. UTC | #1 
Am 25.09.2013 um 16:00 hat Stefan Hajnoczi geschrieben:
> When there are no snapshots qemu_rbd_snap_list() returns 0 and the
> snapshot table pointer is NULL.  Don't forget to free the snaps buffer
> we allocated for librbd rbd_snap_list().
> 
> When the function succeeds don't forget to free the snaps buffer after
> calling rbd_snap_list_end().
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Thanks, updated the block branch with this.

Kevin
diff mbox

Patch

diff --git a/block/rbd.c b/block/rbd.c
index 11086c3..6c65b21 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -943,7 +943,7 @@  static int qemu_rbd_snap_list(BlockDriverState *bs,
     do {
         snaps = g_malloc(sizeof(*snaps) * max_snaps);
         snap_count = rbd_snap_list(s->image, snaps, &max_snaps);
-        if (snap_count < 0) {
+        if (snap_count <= 0) {
             g_free(snaps);
         }
     } while (snap_count == -ERANGE);
@@ -967,6 +967,7 @@  static int qemu_rbd_snap_list(BlockDriverState *bs,
         sn_info->vm_clock_nsec = 0;
     }
     rbd_snap_list_end(snaps);
+    g_free(snaps);
 
  done:
     *psn_tab = sn_tab;