[Devel] [PATCH hci-8.1 v2 0/3] dm-ploop: fix flip_upper_deltas panicking the host in its pre-flip check

[Denis V. Lunev]

ploop_check_delta_before_flip() runs on every flip_upper_deltas, as
PLOOP_DEBUG is always defined in dm-ploop-cmd.c, and has three bugs
(VSTOR-153445):

- patch 1: when it finds a cluster both deltas map, it returns -EEXIST
  with two md_locks held and interrupts disabled. The next pio on that
  BAT page spins on the lock forever, and the host panics on a hard
  lockup;

- patch 2: a flip after a grow of the device, with the lower delta left
  at its old size, oopses in the walk, which runs past the BAT of the
  lower delta. Refuse it: a flip that got past the walk would damage
  the new top delta on the first BAT writeback after resume;

- patch 3: the walk stops one page early when entry nr_be - 1 of the
  lower delta is the first one of its BAT page, and misses a cluster
  both deltas map there.

The ploop library does not get there. Its reverse merge, the only sender
of the flip, grows the lower delta to the size of the top and, with the
device suspended, clears the clusters both deltas map before it flips,
so VSTOR-153445 has no RK for 8.0. This is the fix the v2 cover letter
of "dm-ploop: fix the pio submission stop around cmds" said would be
sent separately.

Tested on dev-cl04, stock 6.12.0-211.52.1.22.11.vz10, dm-ploop built
out of tree with the series on top of the applied dm-ploop v2:
- a chain whose top delta overwrote a cluster of the base, both deltas
  reloaded read-write, and a direct flip_upper_deltas: the message fails
  with EEXIST, the device keeps working and both images pass ploop
  check;
- an online grow from 1G to 2G, both deltas reloaded read-write, a
  direct flip_upper_deltas and then a write past the old size: with v1
  the flip completes and the images no longer open after unmount, the
  ploop target fails the table with EPROTO. With patch 2 alone and with
  the series the flip fails with EBADSLT, and the data below and past
  the old size survives a remount;
- an online grow, a write past the old size, ploop snapshot-delete of
  the base snapshot (the reverse merge of the library) and another write
  past the old size: the flip goes through, the merged image passes
  ploop check and keeps all writes across a remount;
- the ploop pytest suite, ploop and qcow2 formats, passes.

Changes since v1:
- patch 1: drop the read-only and EACCES argument for the library from
  the message, the library reloads the lower delta read-write before
  the flip;
- new patch 2: refuse the flip when the lower delta has fewer BAT
  entries than the device, outside PLOOP_DEBUG;
- patch 3 (was 2/2): say in the message where the old stop matched and
  what it skipped, split the first paragraph, leave the loop with a
  plain break;
- the grow test writes past the old size after the flip.

v1: http://lore.virtuozzo.com/kernel/20261104214635.2063009-1-den@openvz.org/


Denis V. Lunev (3):
  dm-ploop: fix flip_upper_deltas returning with two md_locks held
  dm-ploop: refuse flip_upper_deltas onto a lower delta smaller than the
    device
  dm-ploop: fix the flip_upper_deltas check skipping the last BAT entry

 drivers/md/dm-ploop-cmd.c | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)


base-commit: 1f21db982845109040d1feb279e9ee34f8e6f065
-- 
2.53.0