[Devel] [PATCH hci-8.1 0/3] dm-qcow2: fix merges not stopping the users of the images they change

Denis V. Lunev den at openvz.org
Tue Nov 3 11:37:05 MSK 2026


Checking dm-qcow2 for the same problem showed that a merge does not
stop everything using the images it changes (VSTOR-153049,
VSTOR-153050):

- a backward merge of an inner image pauses that image, while reads
  enter through the top one. A read reaching the inner image as the
  merge starts oopses on a NULL qio->ext (patch 2);

- SEEK_HOLE/SEEK_DATA walks the images without an inflight ref, so
  merge_backward complete frees an image under the walk (patch 3).

Patch 1 (VSTOR-153051) is the counterpart of dm-ploop patch 4, an
error path leaving state behind: after a failed refcount table
relocation, allocating writes past the old refcount coverage fail with
EIO until the device is suspended and resumed.

The series does not depend on the dm-ploop one.

Tested on dev-cl04, stock 6.12.0-211.52.1.22.11.vz10, dm-qcow2 built
out of tree, with a test-only kprobe module widening the windows:
- on the stock module, with 4K clusters and refcount_bits=64 so the
  reftable relocates at 1G, a failed md page insert left every later
  write past 1G failing with EIO; a seek went on with an image
  qcow2_destroy() had freed; an intermediate merge oopsed in
  submit_read_sliced_clu(). None of them reproduce with the series;
- the ploop pytest suite, qcow2 format, passes.

Denis V. Lunev (3):
  dm-qcow2: fix a failed refcount table relocation leaking md pages
  dm-qcow2: fix backward merge of an inner image racing its reads
  dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge

 drivers/md/dm-qcow2-cmd.c | 26 ++++++++++----------------
 drivers/md/dm-qcow2-map.c | 19 ++++++++++++++-----
 2 files changed, 24 insertions(+), 21 deletions(-)


base-commit: 09eb9a82fe872048d082391415d1cdeda2ac6879
-- 
2.53.0



More information about the Devel mailing list