[Devel] [PATCH hci-8.1 v2 3/3] dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge

[no-reply at sashiko.virtuozzo.com]

> From: Denis V. Lunev <den at openvz.org>
> 
> qcow2_llseek_hole() starts at tgt->top and follows qcow2->lower, parsing
> the metadata of each image, with nothing keeping the images alive. dm
> core holds only the table SRCU around the call, which does not keep a
> target message out. merge_backward complete unlinks the merged image,
> waits in qcow2_inflight_ref_switch() for the qios holding refs and
> destroys the image, so a seek already walking it goes on with a freed
> struct qcow2, its md pages and its file. A SEEK_DATA scan of a large
> sparse image keeps the walk running long enough to hit it.
> 
> Hold a per-target rw_semaphore for read over the walk, and for write
> while merge_backward complete unlinks and destroys the image. An
> inflight ref held over the walk would also do, but every inflight ref
> switch would then wait for the whole scan, including the one starting a
> backward merge with the top image paused, which stalls guest I/O for as
> long as the scan runs.
> 
> Fixes: 412d5a4f7bf1 ("dm/dm-qcow2: add llseek_hole")
> https://virtuozzo.atlassian.net/browse/VSTOR-153050
> Feature: dm-qcow2: block device over QCOW2 files driver
> Signed-off-by: Denis V. Lunev <den at openvz.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261103090813.166986-1-den@openvz.org?part=3