block: Deep-clear inherits_from

BDS.inherits_from does not always point to an immediate parent node.
When launching a block job with a filter node, for example, the node
directly below the filter will not point to the filter, but keep its old
pointee (above the filter).

If that pointee goes away while the job is still running, the node's
inherits_from will not be updated and thus point to garbage.  To fix
this, bdrv_unref_child() has to check not only the parent node's
immediate children for nodes whose inherits_from needs to be cleared,
but its whole subtree.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-id: 20190703172813.6868-7-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
Max Reitz 2019-07-03 19:28:07 +02:00
parent 8441d82d51
commit 3cf746b3f1
1 changed files with 24 additions and 10 deletions

34
block.c
View File

@ -2472,18 +2472,20 @@ void bdrv_root_unref_child(BdrvChild *child)
bdrv_unref(child_bs);
}
void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
/**
* Clear all inherits_from pointers from children and grandchildren of
* @root that point to @root, where necessary.
*/
static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
{
if (child == NULL) {
return;
}
BdrvChild *c;
if (child->bs->inherits_from == parent) {
BdrvChild *c;
/* Remove inherits_from only when the last reference between parent and
* child->bs goes away. */
QLIST_FOREACH(c, &parent->children, next) {
if (child->bs->inherits_from == root) {
/*
* Remove inherits_from only when the last reference between root and
* child->bs goes away.
*/
QLIST_FOREACH(c, &root->children, next) {
if (c != child && c->bs == child->bs) {
break;
}
@ -2493,6 +2495,18 @@ void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
}
}
QLIST_FOREACH(c, &child->bs->children, next) {
bdrv_unset_inherits_from(root, c);
}
}
void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
{
if (child == NULL) {
return;
}
bdrv_unset_inherits_from(parent, child);
bdrv_root_unref_child(child);
}