If an AIO request is in flight that refers to a BlockDriverState that has been closed and possibly even freed, more or less anything could happen. I have seen segfaults, -EBADF return values and qcow2 sometimes actually catches the situation in bdrv_close() and abort()s.
Signed-off-by: Kevin Wolf <kw...@redhat.com> --- block.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/block.c b/block.c index c0c90f0..4b96654 100644 --- a/block.c +++ b/block.c @@ -816,6 +816,8 @@ void bdrv_close(BlockDriverState *bs) if (bs->job) { block_job_cancel_sync(bs->job); } + bdrv_drain_all(); + if (bs == bs_snapshots) { bs_snapshots = NULL; } -- 1.7.6.5