Message ID | 1334759190-6313-1-git-send-email-kwolf@redhat.com |
---|---|
State | New |
Headers | show |
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index cbd224d..dcf70a2 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -931,7 +931,7 @@ again: fail: qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); fail_put: - if (nb_clusters > 0) { + if (m->nb_clusters > 0) { QLIST_REMOVE(m, next_in_flight); } return ret;
If do_alloc_cluster_offset() fails, the error handling code tried to remove the request from the in-flight queue, to which it wasn't added yet, resulting in a NULL pointer dereference. m->nb_clusters really only becomes != 0 when the request is in the list. Signed-off-by: Kevin Wolf <kwolf@redhat.com> --- block/qcow2-cluster.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)