[Devel] [PATCH hci-8.1 0/2] dm-ploop: fix flip_upper_deltas panicking the host in its pre-flip check

[Konstantin Khorenko]

I won't apply this version, please send v2 with the changes below.

On Wed, 04 Nov 2026 22:46:33 +0100, Denis V. Lunev wrote:
> Denis V. Lunev (2):
>   dm-ploop: fix flip_upper_deltas returning with two md_locks held
>   dm-ploop: fix flip_upper_deltas walking past the BAT of the lower
>     delta

What to change for v2:

1. Patch 1 and the cover letter, message only: drop the read-only and
   EACCES argument for the library. The code of patch 1 stays as is.

2. Patch 2, code: refuse the flip when the lower delta covers fewer BAT
   entries than the device. Keep the `end` fix. A separate patch placed
   before 2/2 is fine too.

3. Patch 2, message: "the stop never matches" is not exact, and the
   first paragraph needs splitting.

4. Cover letter: redo the grow test with writes past the old size after
   the flip.

Details on items 1-3 are in the replies to the patches. Below are the
details on items 1 and 4.

> Neither is reached through the ploop library. Its reverse merge, the
> only sender of the flip, grows the lower delta to the size of the top
> and clears the clusters both deltas map before it flips, and a device it
> mounted has the lower delta read-only, which the flip refuses with
> EACCES before the check. Both take a flip of a table built with the
> lower delta read-write, so VSTOR-153445 has no RK for 8.0. This is the

Item 1. reverse_merge_online() reloads the table with PLOOP_RELOAD_RW2
right before it suspends and flips, so every library flip passes the
EACCES check and runs ploop_check_delta_before_flip(). The library is
safe only because it grows the lower delta and zeroes the shared
clusters with the device suspended. The "no RK" conclusion holds, the
reason given for it does not.

> - set_noresume, suspend, a grow to 2T and flip_upper_deltas: the stock
>   module oopses at ploop_check_delta_before_flip+0x86, with the series
>   the flip completes and the images keep their data;

Item 4. With patch 2 alone this flip completes with a new top smaller
than the device, and the first BAT writeback after resume damages it
(see the reply to patch 2). The test checked the data right after the
flip, before any write reached the new top.

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team