s->blocker is really only used in hw/scsi/virtio-scsi.c; the only places where it is used in hw/scsi/virtio-scsi-dataplane.c is when it is allocated and when it is freed. That does not make a whole lot of sense (and is actually wrong because this leads to s->blocker potentially being NULL when blk_op_block_all() is called in virtio-scsi.c), so move the allocation and destruction of s->blocker to the device realization and unrealization in virtio-scsi.c, respectively.
Case in point: $ echo -e 'eject drv\nquit' | \ x86_64-softmmu/qemu-system-x86_64 \ -monitor stdio -machine accel=qtest -display none \ -object iothread,id=thr -device virtio-scsi-pci,iothread=thr \ -drive if=none,file=test.qcow2,format=qcow2,id=drv \ -device scsi-cd,drive=drv Without this patch: (qemu) eject drv [1] 10102 done 10103 segmentation fault (core dumped) With this patch: (qemu) eject drv Device 'drv' is busy: block device is in use by data plane (qemu) quit Signed-off-by: Max Reitz <mre...@redhat.com> --- v2: - Put the reproducer into the commit message [Markus] and modified its wording to be more fitting of a commit message ("Case in point" instead of the imperative "Try"). - As noted by Fam on my bdrv_close_all() series, there can be multiple block devices per virtio-scsi bus; therefore, it's wrong to delete the blocker if one of these is unplugged. Instead, just allocate the blocker with the virtio-scsi device itself and free it when the device is unrealized. --- hw/scsi/virtio-scsi-dataplane.c | 4 ---- hw/scsi/virtio-scsi.c | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c index 03a1e8c..9b775d4 100644 --- a/hw/scsi/virtio-scsi-dataplane.c +++ b/hw/scsi/virtio-scsi-dataplane.c @@ -211,8 +211,6 @@ void virtio_scsi_dataplane_start(VirtIOSCSI *s) s->dataplane_starting = true; - assert(!s->blocker); - error_setg(&s->blocker, "block device is in use by data plane"); /* Set up guest notifier (irq) */ rc = k->set_guest_notifiers(qbus->parent, vs->conf.num_queues + 2, true); if (rc != 0) { @@ -279,8 +277,6 @@ void virtio_scsi_dataplane_stop(VirtIOSCSI *s) if (!s->dataplane_started || s->dataplane_stopping) { return; } - error_free(s->blocker); - s->blocker = NULL; s->dataplane_stopping = true; assert(s->ctx == iothread_get_aio_context(vs->conf.iothread)); diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 9e2c718..9c2a272 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -904,6 +904,8 @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp) virtio_scsi_save, virtio_scsi_load, s); s->migration_state_notifier.notify = virtio_scsi_migration_state_changed; add_migration_state_change_notifier(&s->migration_state_notifier); + + error_setg(&s->blocker, "block device is in use by data plane"); } static void virtio_scsi_instance_init(Object *obj) @@ -929,6 +931,8 @@ static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp) { VirtIOSCSI *s = VIRTIO_SCSI(dev); + error_free(s->blocker); + unregister_savevm(dev, "virtio-scsi", s); remove_migration_state_change_notifier(&s->migration_state_notifier); -- 2.1.0