commit_complete() can't assume that after its block_job_completed() the
job is actually immediately freed; someone else may still be holding
references. In this case, the op blockers on the intermediate nodes make
the graph reconfiguration in the completion code fail.

Call block_job_remove_all_bdrv() manually so that we know for sure that
any blockers on intermediate nodes are given up.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/commit.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/block/commit.c b/block/commit.c
index af6fa68..8c09c3d 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -119,6 +119,13 @@ static void commit_complete(BlockJob *job, void *opaque)
     }
     g_free(s->backing_file_str);
     blk_unref(s->top);
+
+    /* If there is more than one reference to the job (e.g. if called from
+     * block_job_finish_sync()), block_job_completed() won't free it and
+     * therefore the blockers on the intermediate nodes remain. This would
+     * cause bdrv_set_backing_hd() to fail. */
+    block_job_remove_all_bdrv(job);
+
     block_job_completed(&s->common, ret);
     g_free(data);
 
-- 
1.8.3.1

On 06/09/2017 06:50 AM, Kevin Wolf wrote:
> commit_complete() can't assume that after its block_job_completed() the
> job is actually immediately freed; someone else may still be holding
> references. In this case, the op blockers on the intermediate nodes make
> the graph reconfiguration in the completion code fail.
> 
> Call block_job_remove_all_bdrv() manually so that we know for sure that
> any blockers on intermediate nodes are given up.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
>  block/commit.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 

Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

On 2017-06-09 13:50, Kevin Wolf wrote:
> commit_complete() can't assume that after its block_job_completed() the
> job is actually immediately freed; someone else may still be holding
> references. In this case, the op blockers on the intermediate nodes make
> the graph reconfiguration in the completion code fail.
> 
> Call block_job_remove_all_bdrv() manually so that we know for sure that
> any blockers on intermediate nodes are given up.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
>  block/commit.c | 7 +++++++
>  1 file changed, 7 insertions(+)

Reviewed-by: Max Reitz <mreitz@redhat.com>