On 11/2/26 17:30, Eric Blake wrote:
> On Fri, Oct 30, 2026 at 12:08:24PM +0100, Denis V. Lunev wrote:
>> On 8/12/26 14:14, Denis V. Lunev wrote:
>>> qom-set of the 'drive' property is allowed on a realized device and ends
>>> up in bdrv_replace_child_bs(), which swaps the node a BdrvChild points to
>>> without telling the parent anything about it. Every other way the size of
>>> a node changes goes through bdrv_co_truncate(), which does notify, so a
>>> device model caching the size of its child has no way to learn that it
>>> changed.
>>>
>>> scsi-disk is the one really hurt by this. check_lba_range() validates
>>> every guest request against SCSIDevice.max_lba, filled in by
>>> scsi_disk_reset() and updated only by the READ CAPACITY(10) and (16)
>>> handlers. Point a scsi-hd at a larger node and every request past the end
>>> of the old one is refused with ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS
>>> OUT OF RANGE for the whole life of the device, which Linux turns into
>>> EREMOTEIO for reads as well as writes. It is silent on the host:
>>> out-of-range requests are answered by scsi_check_condition() and never
>>> reach scsi_handle_rw_error(), so there is no BLOCK_IO_ERROR event and
>>> io-status stays 'ok'. virtio-blk and ide call blk_get_geometry() for
>>> every request, so they end up with a stale idea of the size but never
>>> refuse I/O the node underneath can serve.
>>>
>>> Signed-off-by: Denis V. Lunev <[email protected]>
>>> Cc: Kevin Wolf <[email protected]>
>>> Cc: Hanna Reitz <[email protected]>
>>> Cc: Paolo Bonzini <[email protected]>
>>> Cc: Fam Zheng <[email protected]>
>>>
>>> Denis V. Lunev (4):
>>>   block: notify the parent when a replaced child has a different size
>>>   scsi-disk: refresh the cached capacity from the resize callback
>>>   tests/qtest/virtio-scsi: cover a replacement that changes the size
>>>   tests/qemu-iotests/qom-set-drive: replace with a differently sized
>>>     node
>>>
>>>  block.c                                    | 13 +++++
>>>  hw/scsi/scsi-disk.c                        | 16 ++++--
>>>  include/block/block_int-io.h               |  3 ++
>>>  tests/qemu-iotests/tests/qom-set-drive     | 14 +++--
>>>  tests/qemu-iotests/tests/qom-set-drive.out |  2 +
>>>  tests/qtest/virtio-scsi-test.c             | 63 ++++++++++++++++++++++
>>>  6 files changed, 104 insertions(+), 7 deletions(-)
>>>
>>>
>>> base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
>> ping
> Looks like this one has sat for a while; while it is not directly
> related to my usual NBD pulls, I'm in the middle of preparing a block
> layer pull request today so I'll add this one in my queue if it passes
> my testing.
>
That would be very kind of you.

This one is circulating here for months.

Den

Reply via email to