When the backup-top node transitions from active to inactive in
bdrv_backup_top_drop(), the BlockCopyState is freed and the filtered
child is removed, so the node effectively becomes unusable.
However, noone told its I/O functions this, so they will happily
continue accessing bs->backing and s->bcs. Prevent that by aborting
early when s->active is false.
(After the preceding patch, the node should be gone after
bdrv_backup_top_drop(), so this should largely be a theoretical problem.
But still, better to be safe than sorry, and also I think it just makes
sense to check s->active in the I/O functions.)
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <
20210219153348.41861-3-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
BlockDriverState *bs, uint64_t offset, uint64_t bytes,
QEMUIOVector *qiov, int flags)
{
+ BDRVBackupTopState *s = bs->opaque;
+
+ if (!s->active) {
+ return -EIO;
+ }
+
return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
}
BDRVBackupTopState *s = bs->opaque;
uint64_t off, end;
+ if (!s->active) {
+ return -EIO;
+ }
+
if (flags & BDRV_REQ_WRITE_UNCHANGED) {
return 0;
}