During the 'drive-mirror' operation the target image only has the
monitor reference, therefore there's nothing that prevents its
deletion using the 'x-blockdev-del' command before the block job has
finished.

Signed-off-by: Alberto Garcia <be...@igalia.com>
---
 block/mirror.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/block/mirror.c b/block/mirror.c
index b1252a1..0d136b7 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -385,6 +385,7 @@ static void mirror_exit(BlockJob *job, void *opaque)
     }
     g_free(s->replaces);
     bdrv_unref(s->target);
+    bdrv_unref(s->target); /* extra reference added in mirror_start_job() */
     block_job_completed(&s->common, data->ret);
     g_free(data);
     bdrv_unref(src);
@@ -744,6 +745,11 @@ static void mirror_start_job(BlockDriverState *bs, 
BlockDriverState *target,
         block_job_release(bs);
         return;
     }
+
+    /* We keep an extra reference during the block job so the target
+     * BDS cannot be deleted using x-blockdev-del */
+    bdrv_ref(target);
+
     bdrv_set_enable_write_cache(s->target, true);
     if (s->target->blk) {
         blk_set_on_error(s->target->blk, on_target_error, on_target_error);
-- 
2.6.1


Reply via email to