[Devel] [PATCH hci-8.1 0/3] dm-qcow2: fix merges not stopping the users of the images they change
Denis V. Lunev
den at openvz.org
Tue Nov 3 11:37:05 MSK 2026
Checking dm-qcow2 for the same problem showed that a merge does not
stop everything using the images it changes (VSTOR-153049,
VSTOR-153050):
- a backward merge of an inner image pauses that image, while reads
enter through the top one. A read reaching the inner image as the
merge starts oopses on a NULL qio->ext (patch 2);
- SEEK_HOLE/SEEK_DATA walks the images without an inflight ref, so
merge_backward complete frees an image under the walk (patch 3).
Patch 1 (VSTOR-153051) is the counterpart of dm-ploop patch 4, an
error path leaving state behind: after a failed refcount table
relocation, allocating writes past the old refcount coverage fail with
EIO until the device is suspended and resumed.
The series does not depend on the dm-ploop one.
Tested on dev-cl04, stock 6.12.0-211.52.1.22.11.vz10, dm-qcow2 built
out of tree, with a test-only kprobe module widening the windows:
- on the stock module, with 4K clusters and refcount_bits=64 so the
reftable relocates at 1G, a failed md page insert left every later
write past 1G failing with EIO; a seek went on with an image
qcow2_destroy() had freed; an intermediate merge oopsed in
submit_read_sliced_clu(). None of them reproduce with the series;
- the ploop pytest suite, qcow2 format, passes.
Denis V. Lunev (3):
dm-qcow2: fix a failed refcount table relocation leaking md pages
dm-qcow2: fix backward merge of an inner image racing its reads
dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge
drivers/md/dm-qcow2-cmd.c | 26 ++++++++++----------------
drivers/md/dm-qcow2-map.c | 19 ++++++++++++++-----
2 files changed, 24 insertions(+), 21 deletions(-)
base-commit: 09eb9a82fe872048d082391415d1cdeda2ac6879
--
2.53.0
More information about the Devel
mailing list