[Qemu-devel] [PATCH] usb-storage: Fix how legacy init handles option ID clash

[Qemu-devel] [PATCH] usb-storage: Fix how legacy init handles option ID clash

[Markus Armbruster]

usb_msd_init() calls qemu_opts_create() with a made-up ID and false
fail_if_exists.  If the ID already exists, it happily messes up those
options, then fails drive_new(), because the BlockDriverState with
that ID already exists, too.

Reproducer: -drive if=none,id=usb0,format=raw -usbdevice disk:tmp.qcow2

Pass true fail_if_exists to qemu_opts_create(), and if it fails, try
the next made-up ID.

The reproducer now succeeds, and creates an usb-storage device with ID
usb1.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 hw/usb/dev-storage.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index ae4efcb..eb75f6a 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -666,8 +666,10 @@ static USBDevice *usb_msd_init(USBBus *bus, const char *filename)
     char fmt[32];
 
     /* parse -usbdevice disk: syntax into drive opts */
-    snprintf(id, sizeof(id), "usb%d", nr++);
-    opts = qemu_opts_create(qemu_find_opts("drive"), id, 0, NULL);
+    do {
+        snprintf(id, sizeof(id), "usb%d", nr++);
+        opts = qemu_opts_create(qemu_find_opts("drive"), id, 1, NULL);
+    } while (!opts);
 
     p1 = strchr(filename, ':');
     if (p1++) {
-- 
1.9.3

Re: [Qemu-devel] [PATCH] usb-storage: Fix how legacy init handles option ID clash

[Gerd Hoffmann]

On Fr, 2014-09-12 at 21:24 +0200, Markus Armbruster wrote:
> usb_msd_init() calls qemu_opts_create() with a made-up ID and false
> fail_if_exists.  If the ID already exists, it happily messes up those
> options, then fails drive_new(), because the BlockDriverState with
> that ID already exists, too.
> 
> Reproducer: -drive if=none,id=usb0,format=raw -usbdevice disk:tmp.qcow2
> 
> Pass true fail_if_exists to qemu_opts_create(), and if it fails, try
> the next made-up ID.
> 
> The reproducer now succeeds, and creates an usb-storage device with ID
> usb1.
> 
> Signed-off-by: Markus Armbruster <armbru@redhat.com>

Added to usb patch queue.

thanks,
  Gerd