Re: [PATCH 2/2] block: bdrv_inactivate_recurse(): check for permissions and fix crash

[Hanna Reitz]

On 10.09.21 13:01, Vladimir Sementsov-Ogievskiy wrote:

We must not inactivate child when parent has write permissions on
it.

Calling .bdrv_inactivate() doesn't help: actually only qcow2 has this
handler and it is used to flush caches, not for permission
manipulations.


I guess we could ask whether block jobs should implement 
.bdrv_inactivate() to cancel themselves, but I believe it’s indeed 
better to have the migration fail and thus force the user to manually 
cancel the job (should that be what they want).



So, let's simply check cumulative parent permissions before
inactivating the node.

This commit fixes a crash when we do migration during backup: prior to
the commit nothing prevents all nodes inactivation at migration finish
and following backup write to the target crashes on assertion
"assert(!(bs->open_flags & BDRV_O_INACTIVE));" in
bdrv_co_write_req_prepare().

After the commit, we rely on the fact that copy-before-write filter
keeps write permission on target node to be able to write to it. So
inactivation fails and migration fails as expected.

Corresponding test now passes, so, enable it.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
  block.c| 8 
  tests/qemu-iotests/tests/migrate-during-backup | 2 +-
  2 files changed, 9 insertions(+), 1 deletion(-)


Reviewed-by: Hanna Reitz 

[PATCH 2/2] block: bdrv_inactivate_recurse(): check for permissions and fix crash

[Vladimir Sementsov-Ogievskiy]

We must not inactivate child when parent has write permissions on
it.

Calling .bdrv_inactivate() doesn't help: actually only qcow2 has this
handler and it is used to flush caches, not for permission
manipulations.

So, let's simply check cumulative parent permissions before
inactivating the node.

This commit fixes a crash when we do migration during backup: prior to
the commit nothing prevents all nodes inactivation at migration finish
and following backup write to the target crashes on assertion
"assert(!(bs->open_flags & BDRV_O_INACTIVE));" in
bdrv_co_write_req_prepare().

After the commit, we rely on the fact that copy-before-write filter
keeps write permission on target node to be able to write to it. So
inactivation fails and migration fails as expected.

Corresponding test now passes, so, enable it.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
 block.c| 8 
 tests/qemu-iotests/tests/migrate-during-backup | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index b2b66263f9..ceb2b66afc 100644
--- a/block.c
+++ b/block.c
@@ -6319,6 +6319,7 @@ static int bdrv_inactivate_recurse(BlockDriverState *bs)
 {
 BdrvChild *child, *parent;
 int ret;
+uint64_t cumulative_perms, cumulative_shared_perms;
 
 if (!bs->drv) {
 return -ENOMEDIUM;
@@ -6349,6 +6350,13 @@ static int bdrv_inactivate_recurse(BlockDriverState *bs)
 }
 }
 
+bdrv_get_cumulative_perm(bs, _perms,
+ _shared_perms);
+if (cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
+/* Our inactive parents still need write access. Inactivation failed. 
*/
+return -EPERM;
+}
+
 bs->open_flags |= BDRV_O_INACTIVE;
 
 /*
diff --git a/tests/qemu-iotests/tests/migrate-during-backup 
b/tests/qemu-iotests/tests/migrate-during-backup
index c3b7f1983d..d18e558fa5 100755
--- a/tests/qemu-iotests/tests/migrate-during-backup
+++ b/tests/qemu-iotests/tests/migrate-during-backup
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# group: migration disabled
+# group: migration
 #
 # Copyright (c) 2021 Virtuozzo International GmbH
 #
-- 
2.29.2