commit 6d759117d3fd28e38c49c56c9de206cc718d32fa
author Jeff Cody <jcody@redhat.com> Tue Jan 15 10:47:24 2013 -0500
committer Stefan Hajnoczi <stefanha@redhat.com> Thu Jan 17 10:51:11 2013 +0100
tree e9e722d2b04a3685a42fda0a962a10e6ec85d1f3
parent 47f4dac3fde809e3da4e60d9eb699f1d4b378249

block: fix null-pointer bug on error case in block commit

This is a bug that was caught by a coverity run by Markus.  In
the error case when we errored out to exit_restore_open early in the
function, 'overlay_bs' was still NULL at that point, although it is
used to look up flags and perform a bdrv_reopen().

Move the overlay_bs lookup to where it is needed, and check for NULL
before restoring the flags.  Also get rid of the unneeded parameter
initialization.

Reported-By: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/commit.c

diff --git a/block/commit.c b/block/commit.c
index 61ebdba..553447e 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -65,7 +65,7 @@
     BlockDriverState *active = s->active;
     BlockDriverState *top = s->top;
     BlockDriverState *base = s->base;
-    BlockDriverState *overlay_bs = NULL;
+    BlockDriverState *overlay_bs;
     int64_t sector_num, end;
     int ret = 0;
     int n = 0;
@@ -92,8 +92,6 @@
         }
     }
 
-    overlay_bs = bdrv_find_overlay(active, top);
-
     end = s->common.len >> BDRV_SECTOR_BITS;
     buf = qemu_blockalign(top, COMMIT_BUFFER_SIZE);
 
@@ -156,7 +154,8 @@
     if (s->base_flags != bdrv_get_flags(base)) {
         bdrv_reopen(base, s->base_flags, NULL);
     }
-    if (s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
+    overlay_bs = bdrv_find_overlay(active, top);
+    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
         bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
     }