@@ -45,6 +45,12 @@ static coroutine_fn int backup_top_co_preadv(
BlockDriverState *bs, uint64_t offset, uint64_t bytes,
QEMUIOVector *qiov, int flags)
{
+ BDRVBackupTopState *s = bs->opaque;
+
+ if (!s->active) {
+ return -EIO;
+ }
+
return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
}
@@ -54,6 +60,10 @@ static coroutine_fn int backup_top_cbw(BlockDriverState *bs, uint64_t offset,
BDRVBackupTopState *s = bs->opaque;
uint64_t off, end;
+ if (!s->active) {
+ return -EIO;
+ }
+
if (flags & BDRV_REQ_WRITE_UNCHANGED) {
return 0;
}
When the backup-top node transitions from active to inactive in bdrv_backup_top_drop(), the BlockCopyState is freed and the filtered child is removed, so the node effectively becomes unusable. However, noone told its I/O functions this, so they will happily continue accessing bs->backing and s->bcs. Prevent that by aborting early when s->active is false. (After the preceding patch, the node should be gone after bdrv_backup_top_drop(), so this should largely be a theoretical problem. But still, better to be safe than sorry, and also I think it just makes sense to check s->active in the I/O functions.) Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/backup-top.c | 10 ++++++++++ 1 file changed, 10 insertions(+)