qom-set of the 'drive' property is allowed on a realized device and ends up in bdrv_replace_child_bs(), which swaps the node a BdrvChild points to without telling the parent anything about it. Every other way the size of a node changes goes through bdrv_co_truncate(), which does notify, so a device model caching the size of its child has no way to learn that it changed.
scsi-disk is the one really hurt by this. check_lba_range() validates every guest request against SCSIDevice.max_lba, filled in by scsi_disk_reset() and updated only by the READ CAPACITY(10) and (16) handlers. Point a scsi-hd at a larger node and every request past the end of the old one is refused with ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS OUT OF RANGE for the whole life of the device, which Linux turns into EREMOTEIO for reads as well as writes. It is silent on the host: out-of-range requests are answered by scsi_check_condition() and never reach scsi_handle_rw_error(), so there is no BLOCK_IO_ERROR event and io-status stays 'ok'. virtio-blk and ide call blk_get_geometry() for every request, so they end up with a stale idea of the size but never refuse I/O the node underneath can serve. Signed-off-by: Denis V. Lunev <[email protected]> Cc: Kevin Wolf <[email protected]> Cc: Hanna Reitz <[email protected]> Cc: Paolo Bonzini <[email protected]> Cc: Fam Zheng <[email protected]> Denis V. Lunev (4): block: notify the parent when a replaced child has a different size scsi-disk: refresh the cached capacity from the resize callback tests/qtest/virtio-scsi: cover a replacement that changes the size tests/qemu-iotests/qom-set-drive: replace with a differently sized node block.c | 13 +++++ hw/scsi/scsi-disk.c | 16 ++++-- include/block/block_int-io.h | 3 ++ tests/qemu-iotests/tests/qom-set-drive | 14 +++-- tests/qemu-iotests/tests/qom-set-drive.out | 2 + tests/qtest/virtio-scsi-test.c | 63 ++++++++++++++++++++++ 6 files changed, 104 insertions(+), 7 deletions(-) base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22 -- 2.53.0
