On Thu, Jul 25, 2013 at 05:01:46PM +0800, Fam Zheng wrote: > Previously, nbd calls drive_get_ref() on the drive of bs. A BDS doesn't > always have associated dinfo, which nbd doesn't care either. We already > have BDS ref count, so use it to make it safe for a BDS w/o blockdev. > > Signed-off-by: Fam Zheng <f...@redhat.com> > --- > blockdev-nbd.c | 10 +--------- > nbd.c | 5 +++++ > 2 files changed, 6 insertions(+), 9 deletions(-) > > diff --git a/blockdev-nbd.c b/blockdev-nbd.c > index 95f10c8..922cf56 100644 > --- a/blockdev-nbd.c > +++ b/blockdev-nbd.c > @@ -69,12 +69,6 @@ static void nbd_close_notifier(Notifier *n, void *data) > g_free(cn); > } > > -static void nbd_server_put_ref(NBDExport *exp) > -{ > - BlockDriverState *bs = nbd_export_get_blockdev(exp); > - drive_put_ref(drive_get_by_blockdev(bs)); > -} > - > void qmp_nbd_server_add(const char *device, bool has_writable, bool writable, > Error **errp) > { > @@ -105,11 +99,9 @@ void qmp_nbd_server_add(const char *device, bool > has_writable, bool writable, > writable = false; > } > > - exp = nbd_export_new(bs, 0, -1, writable ? 0 : NBD_FLAG_READ_ONLY, > - nbd_server_put_ref); > + exp = nbd_export_new(bs, 0, -1, writable ? 0 : NBD_FLAG_READ_ONLY, NULL); > > nbd_export_set_name(exp, device); > - drive_get_ref(drive_get_by_blockdev(bs)); > > n = g_malloc0(sizeof(NBDCloseNotifier)); > n->n.notify = nbd_close_notifier; > diff --git a/nbd.c b/nbd.c > index 2606403..f258cdd 100644 > --- a/nbd.c > +++ b/nbd.c > @@ -881,6 +881,7 @@ NBDExport *nbd_export_new(BlockDriverState *bs, off_t > dev_offset, > exp->nbdflags = nbdflags; > exp->size = size == -1 ? bdrv_getlength(bs) : size; > exp->close = close; > + bdrv_ref(bs); > return exp; > } > > @@ -927,6 +928,10 @@ void nbd_export_close(NBDExport *exp) > } > nbd_export_set_name(exp, NULL); > nbd_export_put(exp); > + if (exp->bs) { > + bdrv_unref(exp->bs); > + exp->bs = NULL; > + }
Same thing here - if the refcnt is ever > 1, then this leaks exp->bs. > } > > void nbd_export_get(NBDExport *exp) > -- > 1.8.3.2 > >