Re: [PATCH] block/quorum.c: Decrease child index when del_child

[Alberto Garcia]

On Mon 01 Jun 2020 09:19:56 AM CEST, Zhang Chen wrote:
> From: Zhang Chen <chen.zhang@intel.com>
>
> Fix this bug:
> colo: Can not recover colo after svm failover twice
> https://bugs.launchpad.net/bugs/1881231
>
> The child index still be hold when it be deleted, the max num is 32.
>
> Reported-by: Ye.Zou <ye.zou@zstack.io>
> Signed-off-by: Zhang Chen <chen.zhang@intel.com>
> ---
>  block/quorum.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/block/quorum.c b/block/quorum.c
> index 7cf7ab1546..f71bd4e19d 100644
> --- a/block/quorum.c
> +++ b/block/quorum.c
> @@ -1099,6 +1099,7 @@ static void quorum_del_child(BlockDriverState *bs, 
> BdrvChild *child,
>              (s->num_children - i - 1) * sizeof(BdrvChild *));
>      s->children = g_renew(BdrvChild *, s->children, --s->num_children);
>      bdrv_unref_child(bs, child);
> +    s->next_child_index--;
>  
>      bdrv_drained_end(bs);
>  }

As I explained a few weeks ago this patch is not correct.
quorum_del_child() allows you to remove any child from the Quorum
device, so nothing guarantees that next_child_index-1 is free.

https://lists.gnu.org/archive/html/qemu-block/2020-05/msg00634.html

Berto