[Devel] [PATCH hci-8.1 v9 09/10] dm-qcow2: flag the image for check after a reverted L1/L2 writeback

[Alexander Ivanov]

Done in v10. revert_l_entries_update() now only restores the
old entries and keeps the refcount of the allocated clusters.
complete_wbd() clears FREE_ALLOCATED_CLU on the qios it ends with the
error, so the COW case behind the pe_page branch leaks its cluster too
instead of freeing it in handle_cleanup_mask().

MD_LX_REVERTED, lx_writeback_error and the resume refusal are gone,
and patch 10 no longer needs to skip the shrink for this case: a
leaked cluster keeps its refcount, so the used-end scan does not cut
it off.

On 11/3/26 18:50, Konstantin Khorenko wrote:
> I won't apply this version, please send v10 with the changes below.
>
> On 10/28/26 16:06, Alexander Ivanov wrote:
>>   		if (cleared)
>>   			continue; /* no cluster was allocated */
>>
>> +		wbd->md->status |= MD_LX_REVERTED;
> - Leak the clusters on a failed L1/L2 writeback instead of freeing
>    them.
> - If you keep freeing them, set MD_LX_REVERTED in the pe_page branch
>    above as well.
>
> The pe_page branch restores the old entry and continues before this
> line. It is taken for a COW over a compressed, snapshot-shared or
> preallocated cluster. The new cluster is still freed: the qio waiting
> on the page ends with the error, and handle_cleanup_mask() frees it
> through FREE_ALLOCATED_CLU. So L2 on disk may point to a free cluster,
> lx_writeback_error stays clear, resume is allowed, and patch 10 can
> cut that cluster off.
>
> Freeing also lets the allocator give the cluster to another offset
> before suspend, while L2 on disk still maps the old offset to it. Two
> guest offsets then share one cluster, and the check that wants_check
> asks for cannot undo that. A leaked cluster has none of this: the
> check just frees it.
>
> Leaking also needs no resume refusal. ploop does not look at
> wants_check, so with this patch a transient L2 write error leaves a
> live check or a snapshot with the device suspended.
>