From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D933B80E7E for ; Tue, 3 Nov 2026 08:38:36 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A38bOaR002658; Tue, 3 Nov 2026 11:37:25 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A38bOaR002658 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=default; t=1793695046; bh=NLxnxKzd6gXr3KCny5iRDhSwGgGaZzDABMru2/KVx08=; h=From:To:Date:In-Reply-To:References:Cc:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe; b=nTBGtQaYAOXiLlYtwDmEa0LKG/KxSRHxnlzKcXAupCiSJp0FxWQwPzOYRF7ByGEv/ A/uhPTv0j3zi2AzYCzQaFYiq/fb5GaIBgBBOr8yEUe6dnzNxDfqaBS9ptjKScfhu9P fLfn9K+wD0hIb2GjzMaGcO9SG8LLQr5PlvxPkPaQmZCmB0n2ntF4P4DRNjrleuWa3o qfDSd4uLze8+k2dQpk7cLBIcP1CbqjyY/1KgvsxFFFPii9MspGFl9PXvZtCxbmvt3E 9rWS96Nz9VwbD7zm7vjbxG1bigDyl63j4gqhM8KJ2dG7apngRwVIx9ZOp0hJa1/1+Q Au4hQHaDmcVYg== Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A38bEgP002629 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 11:37:14 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A38bEgP002629 Authentication-Results: mail.openvz.org; dkim=pass (2048-bit key) header.d=openvz.org header.i=@openvz.org header.b="QW4WbeDB" Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48c415561aaso2575410f8f.1 for ; Tue, 03 Nov 2026 00:37:14 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwziAdpgVsGKvVFA3jOQZXS1tgRypuCnqD7dUtGBJt4VWgnVo+GQwYU5dAC843e3eDUHKJlWQ==@openvz.org X-Gm-Message-State: APuU4Z/AfH2txUcNFTWx8jclO98vPOoO+honayzMjEZf+gaVFpEn6CfU hNlb31cS/C4rR6k2wJgxQYdM4+BoIKeSugNtTP1lnvQIymimFPIpsMJpbgEgA9kXhYrFtvb+t7A 6LTBCRrU4ySeqSw4sw6Ie1UDDVlJeZyWPB5ccBNuQOOwVDCT5FdkK5w== X-Gm-Gg: AYBFou39v6l7ipnZs/hDWIKWz5Z26CFXVuWQytZ3xMcg2JBx5cCAEBMnOPE1gT2oJl4 klXrt/FbS1jBleEGXU7ARNc0fLVAU9V1aWCJAOfzWvkxx/DXxws6h6+Qv7yEW+XJiJF7xMRGMMW P0agsPiw6EjtfgikZ2N7ti5zSQWnKLrQ/V8RPr+0um3tM/11To7u0wk3Soc0PmR0qOVSkoJdEc6 DVDIAyLN0JfDR6J23qdSFHg0EnmPVSuKJ/MVF+tdL1rh5htqwMd6sJN55JC+S6IYpdFmmn75/fx r6EDRS74VA== X-Received: by 2002:a05:6000:402c:b0:48d:f39b:83de with SMTP id ffacd0b85a97d-48e6e2bdf87mr31475589f8f.3.1793695034298; Tue, 03 Nov 2026 00:37:14 -0800 (PST) X-Received: by 2002:a05:6000:402c:b0:48d:f39b:83de with SMTP id ffacd0b85a97d-48e6e2bdf87mr31475554f8f.3.1793695033900; Tue, 03 Nov 2026 00:37:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793695033; cv=none; d=google.com; s=arc-20260327; b=J6A6x7rJ2YLmWKH1oCgu3nRGxilPhVJ0RwGHhz2JOxmvABFwO1/3oRu7XjvRZu2bE5 UvAOHLemSyPFkj+oxf+9SKaP3HXM3KMM7ZVH5x5oWHlCQnYiAnUkE+WqvDDCFZouPRrQ B0nqX7OY5sl6CMZMlaw35zVLKxhPEqTSuGCgT+ylRgdvbi6CEa+XQWTw5tt6gEpEa0Ww bfF9Nc4pFu3Vzj3c1BKetbQCDRLM2k4kmZgH1CKBcI1tXLUqq+f1JQEpSFfFiKEGQZjn gUxgDRDFdI6Z29Ggtc+maSOacjIc/1VTohzijI1hHxC9Jb0zirtDM0cN40n6w90kpAty 3wnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=bnm/XNH3FkwjrCqnKZxxMo194v1C/ejoqQ4AfzujKm8=; fh=K/J6oSkdtqUJqR37m0m2e/UAWfK4+Ku5f8ykX3j8VqY=; b=M1Lf1PUI3AcCry4Uhk4hDpyKcdYLwUhSL4KlMxH9INl5ObIbknuGW37yKgnyiz4bX2 FZIBaT0n2SIdh8MHi+wEay4EsC3TqQ+bbEPswRSP6q/1TzLbHla5RrjmGSi8KzfrdCmb xlS1UNX6VW0ZUzZh8OzGhzvakY0boD3LHdEAJPMes4o+1aKBE2hYldcrJKK3x8rslDo7 XxCjFFegQE4NOXevGJ60E24XVz1YKZj4CmjIGExLmYnwjz4NnG9Kp/y+kTUQkxgZBvtY 3dyF9TBiI39ry2/1bGrDG06nUN+UtSS472unVP5QGJAaeu0co3GeZ9TWM7h/l2B/mOB/ LZRw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=QW4WbeDB; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id ffacd0b85a97d-48e765e4828sor499424f8f.10.2026.11.03.00.37.13 for (Google Transport Security); Tue, 03 Nov 2026 00:37:13 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) client-ip=2a06:5b06:b600:300:c789:8bc5:fa8e:d502; Authentication-Results: mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=QW4WbeDB; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793695033; x=1794299833; darn=openvz.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bnm/XNH3FkwjrCqnKZxxMo194v1C/ejoqQ4AfzujKm8=; b=QW4WbeDBS/DyTxRzJN3t3eqTrrqbzpe9JGz7G1b8hOVlA5Y9u+SfrsMBdlsgFnYbZG PGyQoXYTUjyXW66RKHFtp30URmbRQUVfZuJVQm6S5DGAHzUkDfhu9p6C0yAHSS85Qor/ syG5ceEWAK8z03M63JoYKCAYEH/cbE3txbUucGSEsFDk9iGWa9140Ez2NtRAagsZl5Q7 NxpZlcJQ1Bd5KE+LQOJ8mL4tgbsOc5FxDlG/XKTEpsdwF5fPSGiY/tbNl/1D/7+6uj+k jEjPmJKsvd37Alg4VPyqACQs6bNl8/NkEmHXew/SE5013c5RFWek9PsgZcc859Iq6xEV MwNA== X-Forwarded-Encrypted: i=1; AKwUvBzI39X5o81mvPJ5/uHOlNk0d7U3Kkt6PLkYHMSsBsy/3lAaPXgthPthZZgcYt2KewasI6yjEg==@openvz.org X-Received: by 2002:a05:6000:46c5:b0:48d:fd4d:7fbe with SMTP id ffacd0b85a97d-48e6e2bdf92mr19081302f8f.2.1793695033414; Tue, 03 Nov 2026 00:37:13 -0800 (PST) Received: from athena.sw.ru ([2a06:5b06:b600:300:c789:8bc5:fa8e:d502]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e71b9b54dsm23304588f8f.47.2026.11.03.00.37.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 00:37:13 -0800 (PST) From: "Denis V. Lunev" To: andrey.zhadchenko@virtuozzo.com Date: Tue, 3 Nov 2026 09:37:08 +0100 Message-ID: <20261103083708.131379-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261103083708.131379-1-den@openvz.org> References: <20261103083708.131379-1-den@openvz.org> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 3/3] dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Denis V. Lunev qcow2_llseek_hole() starts at tgt->top and follows qcow2->lower, parsing the metadata of each image, without an inflight ref. dm core holds only the table SRCU around the call, which does not keep a target message out. merge_backward complete unlinks the merged image, waits in qcow2_inflight_ref_switch() for the qios holding refs and destroys the image, so a seek already walking it goes on with a freed struct qcow2, its md pages and its file. A SEEK_DATA scan of a large sparse image keeps the walk running long enough to hit it. Hold an inflight ref for the whole walk and take the top image from qcow2_ref_inc() under it. Fixes: 412d5a4f7bf1 ("dm/dm-qcow2: add llseek_hole") https://virtuozzo.atlassian.net/browse/VSTOR-153050 Feature: dm-qcow2: block device over QCOW2 files driver Signed-off-by: Denis V. Lunev --- drivers/md/dm-qcow2-map.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c index 8ab7cb472560..358a71f75cb4 100644 --- a/drivers/md/dm-qcow2-map.c +++ b/drivers/md/dm-qcow2-map.c @@ -4841,18 +4841,25 @@ static int qcow2_llseek_hole_qio(struct qio *qio, int whence, loff_t *result) loff_t qcow2_llseek_hole(struct dm_target *ti, loff_t offset, int whence) { - struct qcow2 *qcow2 = to_qcow2_target(ti)->top; + struct qcow2_target *tgt = to_qcow2_target(ti); loff_t result = -EINVAL; + struct qcow2 *qcow2; struct qio *qio; + u8 ref_index; int ret; + /* Keep merge_backward complete from freeing images under the walk */ + qcow2 = qcow2_ref_inc(tgt, &ref_index); qio = alloc_seek_qio(qcow2, NULL, qcow2->hdr.size); - if (!qio) + if (!qio) { + qcow2_ref_dec(tgt, ref_index); return -ENOMEM; + } seek_qio_set_sector(qio, to_sector(offset)); ret = qcow2_llseek_hole_qio(qio, whence, &result); + qcow2_ref_dec(tgt, ref_index); /* In case of error remap ENXIO as it have special meaning for llseek */ if (ret < 0) return (ret == -ENXIO) ? -EINVAL : ret; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel