During the 'drive-mirror' operation the target image only has the monitor reference, therefore there's nothing that prevents its deletion using the 'x-blockdev-del' command before the block job has finished.
Signed-off-by: Alberto Garcia <be...@igalia.com> --- block/mirror.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/block/mirror.c b/block/mirror.c index b1252a1..0d136b7 100644 --- a/block/mirror.c +++ b/block/mirror.c @@ -385,6 +385,7 @@ static void mirror_exit(BlockJob *job, void *opaque) } g_free(s->replaces); bdrv_unref(s->target); + bdrv_unref(s->target); /* extra reference added in mirror_start_job() */ block_job_completed(&s->common, data->ret); g_free(data); bdrv_unref(src); @@ -744,6 +745,11 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target, block_job_release(bs); return; } + + /* We keep an extra reference during the block job so the target + * BDS cannot be deleted using x-blockdev-del */ + bdrv_ref(target); + bdrv_set_enable_write_cache(s->target, true); if (s->target->blk) { blk_set_on_error(s->target->blk, on_target_error, on_target_error); -- 2.6.1