block/qdev: Allow node name for drive properties
If a node name instead of a BlockBackend name is specified as the driver for a guest device, an anonymous BlockBackend is created now. The order of operations in release_drive() must be reversed in order to avoid a use-after-free bug because now blk_detach_dev() frees the last reference if an anonymous BlockBackend is used. usb-storage uses a hack where it forwards its BlockBackend as a property to another device that it internally creates. This hack must be updated so that it doesn't drop its original BB before it can be passed to the other device. This used to work because we always had the monitor reference around, but with node-names the device reference is the only one now. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
parent
0b8b8753e4
commit
8daea51095
|
@ -72,12 +72,21 @@ static void parse_drive(DeviceState *dev, const char *str, void **ptr,
|
|||
const char *propname, Error **errp)
|
||||
{
|
||||
BlockBackend *blk;
|
||||
bool blk_created = false;
|
||||
|
||||
blk = blk_by_name(str);
|
||||
if (!blk) {
|
||||
BlockDriverState *bs = bdrv_lookup_bs(NULL, str, NULL);
|
||||
if (bs) {
|
||||
blk = blk_new();
|
||||
blk_insert_bs(blk, bs);
|
||||
blk_created = true;
|
||||
}
|
||||
}
|
||||
if (!blk) {
|
||||
error_setg(errp, "Property '%s.%s' can't find value '%s'",
|
||||
object_get_typename(OBJECT(dev)), propname, str);
|
||||
return;
|
||||
goto fail;
|
||||
}
|
||||
if (blk_attach_dev(blk, dev) < 0) {
|
||||
DriveInfo *dinfo = blk_legacy_dinfo(blk);
|
||||
|
@ -91,9 +100,16 @@ static void parse_drive(DeviceState *dev, const char *str, void **ptr,
|
|||
error_setg(errp, "Drive '%s' is already in use by another device",
|
||||
str);
|
||||
}
|
||||
return;
|
||||
goto fail;
|
||||
}
|
||||
|
||||
*ptr = blk;
|
||||
|
||||
fail:
|
||||
if (blk_created) {
|
||||
/* If we need to keep a reference, blk_attach_dev() took it */
|
||||
blk_unref(blk);
|
||||
}
|
||||
}
|
||||
|
||||
static void release_drive(Object *obj, const char *name, void *opaque)
|
||||
|
@ -103,8 +119,8 @@ static void release_drive(Object *obj, const char *name, void *opaque)
|
|||
BlockBackend **ptr = qdev_get_prop_ptr(dev, prop);
|
||||
|
||||
if (*ptr) {
|
||||
blk_detach_dev(*ptr, dev);
|
||||
blockdev_auto_del(*ptr);
|
||||
blk_detach_dev(*ptr, dev);
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -127,7 +143,7 @@ static void set_drive(Object *obj, Visitor *v, const char *name, void *opaque,
|
|||
|
||||
PropertyInfo qdev_prop_drive = {
|
||||
.name = "str",
|
||||
.description = "ID of a drive to use as a backend",
|
||||
.description = "Node name or ID of a block device to use as a backend",
|
||||
.get = get_drive,
|
||||
.set = set_drive,
|
||||
.release = release_drive,
|
||||
|
@ -362,8 +378,19 @@ PropertyInfo qdev_prop_vlan = {
|
|||
void qdev_prop_set_drive(DeviceState *dev, const char *name,
|
||||
BlockBackend *value, Error **errp)
|
||||
{
|
||||
object_property_set_str(OBJECT(dev), value ? blk_name(value) : "",
|
||||
name, errp);
|
||||
const char *ref = "";
|
||||
|
||||
if (value) {
|
||||
ref = blk_name(value);
|
||||
if (!*ref) {
|
||||
BlockDriverState *bs = blk_bs(value);
|
||||
if (bs) {
|
||||
ref = bdrv_get_node_name(bs);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
object_property_set_str(OBJECT(dev), ref, name, errp);
|
||||
}
|
||||
|
||||
void qdev_prop_set_chr(DeviceState *dev, const char *name,
|
||||
|
|
|
@ -609,10 +609,12 @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
|
|||
* a SCSI bus that can serve only a single device, which it
|
||||
* creates automatically. But first it needs to detach from its
|
||||
* blockdev, or else scsi_bus_legacy_add_drive() dies when it
|
||||
* attaches again.
|
||||
* attaches again. We also need to take another reference so that
|
||||
* blk_detach_dev() doesn't free blk while we still need it.
|
||||
*
|
||||
* The hack is probably a bad idea.
|
||||
*/
|
||||
blk_ref(blk);
|
||||
blk_detach_dev(blk, &s->dev.qdev);
|
||||
s->conf.blk = NULL;
|
||||
|
||||
|
@ -623,6 +625,7 @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
|
|||
scsi_dev = scsi_bus_legacy_add_drive(&s->bus, blk, 0, !!s->removable,
|
||||
s->conf.bootindex, dev->serial,
|
||||
&err);
|
||||
blk_unref(blk);
|
||||
if (!scsi_dev) {
|
||||
error_propagate(errp, err);
|
||||
return;
|
||||
|
|
Loading…
Reference in a new issue