From 319ae529b8d55ea60b1036809aaab2130048d0e1 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Fri, 28 Jan 2011 11:21:46 +0100 Subject: blockdev: Fix drive_add for drives without media Watch this: (qemu) drive_add 0 if=none (qemu) info block none0: type=hd removable=0 [not inserted] (qemu) drive_del none0 Segmentation fault (core dumped) add_init_drive() is confused about drive_init()'s failure modes, and cleans up when it shouldn't. This leaves the DriveInfo with member opts dangling. drive_del attempts to free it, and dies. drive_init() behaves as follows: * If it created a drive with media, it returns its DriveInfo. * If it created a drive without media, it clears *fatal_error and returns NULL. * If it couldn't create a drive, it sets *fatal_error and returns NULL. Of its three callers: * drive_init_func() is correct. * usb_msd_init() assumes drive_init() failed when it returns NULL. This is correct only because it always passes option "file", and "drive without media" can't happen then. * add_init_drive() assumes drive_init() failed when it returns NULL. This is incorrect. Clean up drive_init() to return NULL on failure and only on failure. Drop its parameter fatal_error. Signed-off-by: Markus Armbruster Signed-off-by: Kevin Wolf --- blockdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'blockdev.h') diff --git a/blockdev.h b/blockdev.h index e5d8c56..84e462a 100644 --- a/blockdev.h +++ b/blockdev.h @@ -48,7 +48,7 @@ DriveInfo *drive_get_by_blockdev(BlockDriverState *bs); QemuOpts *drive_def(const char *optstr); QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file, const char *optstr); -DriveInfo *drive_init(QemuOpts *arg, int default_to_scsi, int *fatal_error); +DriveInfo *drive_init(QemuOpts *arg, int default_to_scsi); /* device-hotplug */ -- cgit v1.1