[Devel] [PATCH hci-8.1 v2 1/3] dm-qcow2: fix a failed refcount table relocation leaking md pages

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

relocate_refcount_table() inserts md pages for the last cluster of the
new reftable and for the new refblocks, one page at a time from
pos + old_clus * clu_size up to r2_end. On error it frees pages from
end only, one per cluster, so the pages of the new reftable cluster
and all but the first page of each refblock cluster bigger than a page
stay in md_pages.

The header is rolled back, so the next allocation past the old refcount
coverage relocates the table again. Its first insert finds a leaked page
and fails with -EEXIST, the relocation returns -EIO, and every
allocating write beyond the old coverage fails with an I/O error until
the device is suspended and resumed or the table is reloaded. A failed
page allocation or a failed header write is enough to get there.

Free exactly the pages the allocation loop inserted.

Note for a future reader: the pages are freed without being unlinked
from the writeback lists. That is safe for the failures above, which
happen before any page in the range is dirtied. Pages get dirty only
after the header write, and the gotos after it are WARN_ON_ONCE()
branches that leave the on-disk header pointing at the new table. Those
want the image switched to read-only, as the TODO there says, not more
cleanup.

Fixes: 222b6f1291c1 ("dm-qcow2: Introduce driver to create block devices over QCOW2 files")
https://virtuozzo.atlassian.net/browse/VSTOR-153051
Feature: dm-qcow2: block device over QCOW2 files driver
Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/md/dm-qcow2-map.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c
index 78ee7cf5e881..8ab7cb472560 100644
--- a/drivers/md/dm-qcow2-map.c
+++ b/drivers/md/dm-qcow2-map.c
@@ -2279,6 +2279,7 @@ static void set_reftable_in_raw_hdr(struct page *page0, loff_t pos, loff_t clus)
 static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 {
 	loff_t i, old_pos, old_end, pos, end, r2_end, delta;
+	loff_t new_md_start, new_md_end;
 	u32 old_clus, clus, clu_size = qcow2->clu_size;
 	u32 r2_clus, bits = qcow2->refblock_bits;
 	unsigned long nr_pages, index;
@@ -2342,8 +2343,9 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 		return ret;
 
 	/* Alloc R1/R2 pages covering clusters of new R1 and new R2 */
-	for (i = pos + (u64)old_clus * clu_size; i < r2_end; i += PAGE_SIZE) {
-		ret = qcow2_alloc_and_insert_md_page(qcow2, i >> PAGE_SHIFT, &md);
+	new_md_start = pos + (u64)old_clus * clu_size;
+	for (new_md_end = new_md_start; new_md_end < r2_end; new_md_end += PAGE_SIZE) {
+		ret = qcow2_alloc_and_insert_md_page(qcow2, new_md_end >> PAGE_SHIFT, &md);
 		if (ret < 0)
 			goto err_free_r2_pages;
 		spin_lock_irq(&qcow2->md_pages_lock);
@@ -2419,7 +2421,7 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 	return 1;
 
 err_free_r2_pages:
-	for (i = end; i < r2_end; i += clu_size) {
+	for (i = new_md_start; i < new_md_end; i += PAGE_SIZE) {
 		ret = handle_md_page(qcow2, i >> PAGE_SHIFT, NULL, &md);
 		if (ret <= 0)
 			break;
-- 
2.53.0