From: John Ferlan <jferlan@redhat.com>
Date: Thu, 25 Feb 2016 20:47:56 +0000 (-0500)
Subject: storage: Fix error path in storagePoolDefineXML
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=ee67069c73cb91e3762cc63587d2a14d9a7253af;p=libvirt.git

storage: Fix error path in storagePoolDefineXML

Found by inspection - after calling virStoragePoolObjAssignDef the
pool is part of the driver->pools.objs list and the failure path
for the virStoragePoolObjSaveDef will use virStoragePoolObjRemove
to remove the pool from the objs list which will unlock and free
the pool pointer (as pools->objs[i] during the loop). Since the call
doesn't clear the pool address from the callee, we need to set it
to NULL; otherwise, the virStoragePoolObjUnlock in the cleanup: code
will fail miserably.
---

diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
index e0ded01619..1d96618b16 100644
--- a/src/storage/storage_driver.c
+++ b/src/storage/storage_driver.c
@@ -784,6 +784,7 @@ storagePoolDefineXML(virConnectPtr conn,
     if (virStoragePoolObjSaveDef(driver, pool, def) < 0) {
         virStoragePoolObjRemove(&driver->pools, pool);
         def = NULL;
+        pool = NULL;
         goto cleanup;
     }
     def = NULL;