[Devel] [PATCH hci-8.1 v11 07/10] dm-qcow2: flag the image for check if reftable relocation fails late

[Alexander Ivanov]

Once relocate_refcount_table() has issued the header write pointing to
the new reftable, any failure returns -EIO. The header on disk may
already point to the new reftable even if its own write fails: a short
write is reported as -ENODATA, and the old reftable position is
restored only in the cached header page, which a v2 image never
rewrites on suspend. The new reftable on disk may then be unfilled or
miss the new refblocks, while refcounts of the new and old reftable
clusters may not be updated. Refcounts no longer match the header, but
nothing reports that, so the device can be resumed and the image
reopened as if it were consistent.

Set md_writeback_error on these paths, so wants_check reports the image
and resume is refused until it is checked, and log the failure.

https://virtuozzo.atlassian.net/browse/VSTOR-148171
Feature: dm-qcow2: block device over QCOW2 files driver
Fixes: 222b6f1291c1c ("dm-qcow2: Introduce driver to create block devices over QCOW2 files")

Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/md/dm-qcow2-map.c | 44 ++++++++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c
index 7866c791325b..995f611ae5bb 100644
--- a/drivers/md/dm-qcow2-map.c
+++ b/drivers/md/dm-qcow2-map.c
@@ -2247,7 +2247,7 @@ static void set_reftable_in_raw_hdr(struct page *page0, loff_t pos, loff_t clus)
  * complicated, we should not demonstrate excessive creativity
  * and optimize it in prejudice of readability.
  *
- * We act in the way to provide safe rollback throughout whole function.
+ * We act in the way to provide safe rollback until new hdr is written.
  * Firstly, we cache every related md we're going to use on relocation.
  * New reftable (R1) is placed next to max cluster covered by old R1.
  * Since new reftable (R1) clusters should be marked as used after
@@ -2256,8 +2256,10 @@ static void set_reftable_in_raw_hdr(struct page *page0, loff_t pos, loff_t clus)
  * clusters are in the part of file, which is not covered by old R1.
  *
  * Then, we try to write new hdr on disk. In case of failure, we
- * restore old hdr in memory and do safe rollback. In case of success,
- * there should not be more reasons to fail (only this driver's bugs).
+ * restore old hdr in memory, but the write may have reached the disk,
+ * so the image is flagged for check (md_writeback_error). In case of
+ * success, there should not be more reasons to fail (only this driver's
+ * bugs); such a failure flags the image for check too.
  * Cached old reftable (R1) pages we renumber to point to new reftable (R1)
  * place. Then we mark old reftable (R1) clusters as unused, while
  * new reftable (R1) clusters as used.
@@ -2351,6 +2353,10 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 	if (ret) {
 		/* Restore old R1 */
 		set_reftable_in_raw_hdr(md0->page, old_pos, old_clus);
+		QC_ERR(qcow2->tgt->ti,
+		       "failed to write header with relocated refcount table: %d",
+		       ret);
+		qcow2->tgt->md_writeback_error = true;
 		goto err_free_r2_pages;
 	}
 
@@ -2372,24 +2378,27 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 		if (!WARN_ON_ONCE(!md))
 			qcow2_md_make_dirty(qcow2, md, true);
 		if (!md)
-			break; /* goto err_eio */
+			break;
 	}
 	spin_unlock_irq(&qcow2->md_pages_lock);
-	if (i != nr_pages)
-		goto err_eio;
+	if (i != nr_pages) {
+		ret = -ENOENT;
+		goto err_hdr_written;
+	}
 
 	/* Connect new R2 to new R1: one for each group new R1 and R2 span */
 	group_size = (u64)qcow2->refblock_entries * clu_size;
 	for (i = pos, r2_pos = end; i < r2_end; i += group_size, r2_pos += clu_size) {
-		if (WARN_ON_ONCE(r2_pos >= r2_end))
-			goto err_eio;
-		if (calc_refcounters_map(qcow2, i, &r1, &r2) < 0) {
-			WARN_ON_ONCE(1);
-			goto err_eio;
+		if (WARN_ON_ONCE(r2_pos >= r2_end)) {
+			ret = -ERANGE;
+			goto err_hdr_written;
 		}
+		ret = calc_refcounters_map(qcow2, i, &r1, &r2);
+		if (WARN_ON_ONCE(ret < 0))
+			goto err_hdr_written;
 		ret = handle_md_page(qcow2, r1.page_id, NULL, &md);
 		if (WARN_ON_ONCE(ret <= 0))
-			goto err_eio;
+			goto err_hdr_written;
 		spin_lock_irq(&qcow2->md_pages_lock);
 		set_u64_to_be_page(md->page, r1.index_in_page, r2_pos);
 		qcow2_md_make_dirty(qcow2, md, true);
@@ -2400,7 +2409,7 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 	for (i = pos; i < r2_end; i += clu_size) {
 		ret = qcow2_handle_r1r2_maps(qcow2, i, NULL, &r1, &r2, false);
 		if (WARN_ON_ONCE(ret <= 0))
-			goto err_eio;
+			goto err_hdr_written;
 		mark_cluster_used(qcow2, r2.md, r2.index_in_page);
 	}
 
@@ -2408,12 +2417,18 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 	for (i = old_pos; i < old_end; i += clu_size) {
 		ret = qcow2_handle_r1r2_maps(qcow2, i, NULL, &r1, &r2, false);
 		if (WARN_ON_ONCE(ret <= 0))
-			goto err_eio;
+			goto err_hdr_written;
 		mark_cluster_unused(qcow2, r2.md, r2.index_in_page, i);
 	}
 
 	return 1;
 
+err_hdr_written:
+	/* 0: md page is not cached */
+	QC_ERR(qcow2->tgt->ti, "failed to fill relocated refcount table: %d",
+	       ret ?: -ENOENT);
+	qcow2->tgt->md_writeback_error = true;
+	return -EIO;
 err_free_r2_pages:
 	for (i = new_md_start; i < new_md_end; i += PAGE_SIZE) {
 		ret = handle_md_page(qcow2, i >> PAGE_SHIFT, NULL, &md);
@@ -2424,7 +2439,6 @@ static int relocate_refcount_table(struct qcow2 *qcow2, struct qio **qio)
 		spin_unlock_irq(&qcow2->md_pages_lock);
 		qcow2_free_md_page(md);
 	}
-err_eio:
 	/* TODO: switch to RO */
 	return -EIO;
 }
-- 
2.53.0