On Mon, Jul 20, 2026 at 16:06:24 +0900, Mitsuru Kariya via Devel wrote:

qemuDomainChangeEjectableMedia() ran qemuDomainPrepareDiskSource() and the surrounding image setup (backing chain detection, storage access, managed PR) unconditionally. When ejecting to no media the new source is empty, and qemuDomainPrepareDiskSource() still assigned it node names that are never realized in QEMU, leaving a stale name in the disk source

This by itself is not a problem. In addition some of the functions don't do anything at all for empty source. But I agree that setting up all of this is pointless.

that a later detach would then try to blockdev-del.

This is not really fixed by this, you'd get a different error because in qemuBlockStorageSourceDetachPrepare data->storageNodeName would be NULL, but data->storageAttached is still set to true. qemuBlockStorageSourceChainDetach then would call qemuMonitorBlockdevDel with NULL argument, which would report an JSON formatting error as 'node-name' is mandatory. Thus the code was doing pointless stuff but this commit isn't fixing anything regarding to the previous error.

Wrap the image setup in a virStorageSourceIsEmpty() check, mirroring qemuDomainAttachDeviceDiskLiveInternal(), and only revoke storage access on rollback when it was actually granted, using a releaseSeclabel flag as the attach path already does.

Signed-off-by: Mitsuru Kariya <Mitsuru.Kariya@oss.nttdata.com> --- src/qemu/qemu_hotplug.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c2cd5496e0..b96ff24cbf 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -612,6 +612,7 @@ qemuDomainChangeEjectableMedia(virQEMUDriver *driver, qemuDomainObjPrivate *priv = vm->privateData; virStorageSource *oldsrc = disk->src; qemuDomainDiskPrivate *diskPriv = QEMU_DOMAIN_DISK_PRIVATE(disk); + bool releaseSeclabel = false; int rc;

if (diskPriv->blockjob && qemuBlockJobIsRunning(diskPriv->blockjob)) { @@ -625,17 +626,21 @@ qemuDomainChangeEjectableMedia(virQEMUDriver *driver, if (virDomainDiskTranslateSourcePool(disk) < 0) goto rollback;

- if (qemuDomainDetermineDiskChain(driver, vm, disk, NULL) < 0) - goto rollback; + if (!virStorageSourceIsEmpty(newsrc)) { + if (qemuDomainDetermineDiskChain(driver, vm, disk, NULL) < 0) + goto rollback;

- if (qemuDomainPrepareDiskSource(disk, priv, cfg) < 0) - goto rollback; + if (qemuDomainPrepareDiskSource(disk, priv, cfg) < 0) + goto rollback;

- if (qemuDomainStorageSourceChainAccessAllow(driver, vm, newsrc) < 0) - goto rollback; + if (qemuDomainStorageSourceChainAccessAllow(driver, vm, newsrc) < 0) + goto rollback;

- if (qemuHotplugAttachManagedPR(vm, newsrc, VIR_ASYNC_JOB_NONE) < 0) - goto rollback; + releaseSeclabel = true; + + if (qemuHotplugAttachManagedPR(vm, newsrc, VIR_ASYNC_JOB_NONE) < 0) + goto rollback; + }

rc = qemuDomainChangeMediaBlockdev(vm, disk, oldsrc, newsrc, force);

@@ -653,7 +658,8 @@ qemuDomainChangeEjectableMedia(virQEMUDriver *driver, return 0;

rollback: - ignore_value(qemuDomainStorageSourceChainAccessRevoke(driver, vm, newsrc)); + if (releaseSeclabel) + ignore_value(qemuDomainStorageSourceChainAccessRevoke(driver, vm, newsrc));

qemuHotplugRemoveManagedPR(vm, newsrc, VIR_ASYNC_JOB_NONE);

I'll tweak the commit message slightly. Reviewed-by: Peter Krempa <pkrempa@redhat.com>

On Mon, Jul 20, 2026 at 16:06:23 +0900, Mitsuru Kariya via Devel wrote:

qemuDomainRemoveDiskDevice() called qemuBlockStorageSourceChainDetachPrepareBlockdev() unconditionally. A CD-ROM with no media has an empty source (path == NULL), for which

The condition for a source being empty is a bit more complex, because NBD network devices can be full and have NULL path.

virStorageSourceIsEmpty() returns true while virStorageSourceIsBacking() still returns true, so the chain walk prepared a blockdev-del for a node

Yeah, unfortunately due to historical reasons an empty drive is of type _FILE and empty path.

that was never created in QEMU. Detaching such a device produced an internal error, either "Failed to find node with node-name='libvirt-N-storage'" (when a prior eject had left a stale node name in the source) or "argument key 'node-name' must not have null value".

Guard the detach preparation with virStorageSourceIsEmpty(), as the old-media detach in qemuDomainChangeMediaBlockdev() already does. The following qemuBlockStorageSourceChainDetach() and access revoke are already guarded by a non-NULL diskBackend, so an empty source is left untouched.

Signed-off-by: Mitsuru Kariya <Mitsuru.Kariya@oss.nttdata.com> --- src/qemu/qemu_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 5be567b510..c2cd5496e0 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -4861,7 +4861,8 @@ qemuDomainRemoveDiskDevice(virQEMUDriver *driver, diskPriv->blockjob->disk = NULL; g_clear_pointer(&diskPriv->blockjob, virObjectUnref); } else { - if (!(diskBackend = qemuBlockStorageSourceChainDetachPrepareBlockdev(disk->src))) + if (!virStorageSourceIsEmpty(disk->src) && + !(diskBackend = qemuBlockStorageSourceChainDetachPrepareBlockdev(disk->src))) goto cleanup; }

I'll drop the node about path==NULL because the rest is explanatory enough. Reviewed-by: Peter Krempa <pkrempa@redhat.com>