Am 24.08.2026 um 15:37 hat Denis V. Lunev geschrieben: > From: Denis V. Lunev <[email protected]> > > qcow2_signal_corruption() drops bs->drv, so a node can lose its driver > at any time and a reopen has to expect that. Both ends of the path > assume otherwise: > > $ qemu-io -c "read 0 64k" -c "reopen -r" corrupt.qcow2 > qcow2: Marking image as corrupt: Cluster allocation offset 0x1200 > unaligned (L2 offset: 0x40000, L2 index: 0); ... > Segmentation fault > > bdrv_reopen_queue_child() dereferences bs->drv while descending into > the children the node opened itself, and bdrv_reopen_prepare() asserts > on it. commit_clean() reopens the base of a commit job back to > read-only, so a base which goes corrupt under the job arrives here too. > > There is nothing to reopen for such a node, so stop descending into its > children and let bdrv_reopen_prepare() report what every caller of > bdrv_reopen() already handles. bdrv_reopen_commit() and > bdrv_reopen_abort() keep their assertion, only a prepared entry reaches > them. > > Signed-off-by: Denis V. Lunev <[email protected]> > Reviewed-by: Andrey Drobyshev <[email protected]> > CC: Kevin Wolf <[email protected]> > CC: Hanna Reitz <[email protected]> > CC: Andrey Drobyshev <[email protected]> > Cc: [email protected]
Reviewed-by: Kevin Wolf <[email protected]>
