qcow2: Fix fail path in realloc_refcount_block()
commita134d90f50806597c5da4fd191352fe62d40f71a
authorMax Reitz <mreitz@redhat.com>
Mon, 17 Mar 2014 22:04:52 +0000 (17 23:04 +0100)
committerKevin Wolf <kwolf@redhat.com>
Wed, 19 Mar 2014 08:39:41 +0000 (19 09:39 +0100)
treed395522876aa647f41a62b0457e0be085fa4d52f
parent8a15b813e6034856d4177c6ab242791795434c15
qcow2: Fix fail path in realloc_refcount_block()

If qcow2_alloc_clusters() fails, new_offset and ret will both be
negative after the fail label, thus passing the first if condition and
subsequently resulting in a call of qcow2_free_clusters() with an
invalid (negative) offset parameter. Fix this by introducing a new label
"fail_free_cluster" which is only invoked if new_offset is indeed
pointing to a newly allocated cluster that should be cleaned up by
freeing it.

While we're at it, clean up the whole fail path. qcow2_cache_put()
should (and actually can) never fail, hence the return value can safely
be ignored (aside from asserting that it indeed did not fail).

Furthermore, there is no reason to give QCOW2_DISCARD_ALWAYS to
qcow2_free_clusters(), a mere QCOW2_DISCARD_OTHER will suffice.

Ultimately, rename the "fail" label to "done", as it is invoked both on
failure and success.

Suggested-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/qcow2-refcount.c