[Qemu-devel] [PATCH V3 1/7] qcow2: restore nb_snapshots when fail in snapshot creation

[Wenchao Xia]

If it is not restored after qcow2_write_snapshots() fail, a core
dump will happen in bdrv_close() since access of invalid pointer.

Signed-off-by: Wenchao Xia <xiaw...@linux.vnet.ibm.com>
---
 block/qcow2-snapshot.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index e7e6013..40393b2 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -331,7 +331,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, 
QEMUSnapshotInfo *sn_info)
     QCowSnapshot *new_snapshot_list = NULL;
     QCowSnapshot *old_snapshot_list = NULL;
     QCowSnapshot sn1, *sn = &sn1;
-    int i, ret;
+    int i, ret, old_snapshot_num = 0;
     uint64_t *l1_table = NULL;
     int64_t l1_table_offset;
 
@@ -403,6 +403,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, 
QEMUSnapshotInfo *sn_info)
         memcpy(new_snapshot_list, s->snapshots,
                s->nb_snapshots * sizeof(QCowSnapshot));
         old_snapshot_list = s->snapshots;
+        old_snapshot_num = s->nb_snapshots;
     }
     s->snapshots = new_snapshot_list;
     s->snapshots[s->nb_snapshots++] = *sn;
@@ -411,6 +412,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, 
QEMUSnapshotInfo *sn_info)
     if (ret < 0) {
         g_free(s->snapshots);
         s->snapshots = old_snapshot_list;
+        s->nb_snapshots = old_snapshot_num;
         goto fail;
     }
 
-- 
1.7.1