On Mon 11 May 2020 12:00:30 PM CEST, quwei...@huayun.com wrote: > diff --git a/block/quorum.c b/block/quorum.c > index 6d7a56b..a8272fe 100644 > --- a/block/quorum.c > +++ b/block/quorum.c > @@ -1096,6 +1096,7 @@ static void quorum_del_child(BlockDriverState *bs, > BdrvChild *child, > memmove(&s->children[i], &s->children[i + 1], > (s->num_children - i - 1) * sizeof(BdrvChild *)); > s->children = g_renew(BdrvChild *, s->children, --s->num_children); > + s->next_child_index--; > bdrv_unref_child(bs, child);
This is not correct, quorum_del_child() allows you to remove any child from the Quorum device, so nothing guarantees you that next_child_index-1 is free. Berto