From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id B3F4D8017D for ; Wed, 4 Nov 2026 18:48:39 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4IlPj8026061; Wed, 4 Nov 2026 21:47:26 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4IlPj8026061 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=default; t=1793818047; bh=7Bb5xt349pLN+hi9qQucgx/1FVtTzg6teucPqFJKF/Y=; h=From:To:Date:In-Reply-To:References:Cc:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe; b=Kq3rHc2VgY+fqJxjqZsif00aUltiuOsX570+DLL+kBmOkmnjKaW4w+fo1AJD3Wpn+ 0OsVI27VL8xI/w+JOC0SnfypDNG/KrDU/AnxSagYLjPxTNszJNV/FyGRG1O+FkCWxl d22VMMR2pMYFsTa1XSTRuWntQ3klG/7IKXD5tQzOeKDSfROwrKKq9cbyIowPu6ik3z E09YGTWJnkSRZJfrYOlT0PjWpGb3qbDiwjx4Z9OVGReWyg82062vpaqq868FvzloGB p5DD0Iir+JLOGKDX5IHP/rKlL/Oa4CTUayvT9ShacKvG7/kx4xSeq3bE4obF4OaUiH OTlN5KNlyJF4w== Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4IlO6k026057 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 4 Nov 2026 21:47:25 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4IlO6k026057 Authentication-Results: mail.openvz.org; dkim=pass (2048-bit key) header.d=openvz.org header.i=@openvz.org header.b="oNQizsN1" Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-6b4f1fcf171so1180744a12.1 for ; Wed, 04 Nov 2026 10:47:25 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBye4nm0xOAEyxKWAS+7hU1DqLHjZljU85zOPEjkntQscovp54ghiAJNCOnJYt0cADecmMQ78Q==@openvz.org X-Gm-Message-State: APuU4Z9lVUN82R+XIoKqxHAJvA+/3ESrIdYA7VXa5wV3B0W3tQ0nNliK oyj3hRz9ENVK1KsiwVtCDl4xicbnPt+u/K1U2y8tDEpjh1Oq8aVQdAvLC2spewyxytuE5o3+zVz lwnUOXHsFcQKKWqhDy+Kj7tp37I2B1yQkwBjbrnxW8qo1iVBYd8DpdA== X-Gm-Gg: AYBFou2DTe2gq8ROqPtspao4nkeWznGMa1dun18RekN8pjRDTlq8/FwabTEhbyWZca8 BfDYTbzVVb/yeXPMCK8NKvRUqXJy6JA73UVIIlfYra9HyY1/0YNmNBmkMIhJZmeLJnTIdQKzVeT zOFsQNyUilbCpnJZTn4V3PJIelyOcsghprQcmLG9nYu1zZaFE5VgbFIKnqTSOJmeIz0GTXNzsN4 zGPNNLfVQuKiuvzNwi3kAAo5ebbDhEppz3gByX6dvhd7UYa14rcWJkXNXuYKV+oG4W6lj1+BylF qElj6aF3KA== X-Received: by 2002:a05:600c:848c:b0:4a5:dc5d:20f7 with SMTP id 5b1f17b1804b1-4ac175669d8mr419087685e9.14.1793815272433; Wed, 04 Nov 2026 10:01:12 -0800 (PST) X-Received: by 2002:a05:600c:848c:b0:4a5:dc5d:20f7 with SMTP id 5b1f17b1804b1-4ac175669d8mr419087295e9.14.1793815272045; Wed, 04 Nov 2026 10:01:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793815272; cv=none; d=google.com; s=arc-20260327; b=B/GjupSkY3a/KVWUcQwes9pTSksFKY63eNYV6arsBGvCMMRsn134jaE9OSsdxGTby6 bJ9Qw+WlhWkRktSCK5RHbEXYmNStDcKyDjqf1Z++9LvLZjkgOIroTca6VqFWwpXusv1B QVmyAl2iJp7ADHFsarzt1MeNV3nws/rDDoTnE11BSlH79Q85WIZJ05qCoix45y9gSnag D5/c8jYMzd8QM4x8NWQa6NXxqSgTsIu0opPdSTxv+9bNZsvH77lPuEtAGCOXXL0bUqvp oeENOM8ql6XtEXcBtDrST7ASA+6k5l2uwoqiJg5gGtVT+ePfDz+1gPPdIaLtDUwypM8e cUMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=e9X/cVXT6P2boQJIAKpW97E0bdvBM79HZpk8zDRhhtI=; fh=7eNkJ/N1N2GvmCUANvrhkSmtxOUx0y7ekAHla6HJNsc=; b=HWNJX8ALXY6mBWGM3/PQpBNBkDhdHvWWs8mKxqGCyI0KpLzEmCu9C3sebbDzfZfCav 16fTe58ozAHCOR2VTb9D82dkfAWupq23QzQUD9a48Vqkip4r6sajHr9Rcazz25cdR5dH +k/sS8llyj1PperNJ/reSNfLB3tCaZZHMmqV/lx/rDRZR/vHYikse1X4XgyuoarYEa4X 7gXrrYg86Lcqob3Wp5P6TNiEi6MHNBOXcaxD6cf+pQ1AwqNLU2iISVe+jwSTXZ46dEuZ q3no2M8XolCBJ+2JqqLXd9Og6HpspRdLx39KAce+BmWPxf5pRhJan7flqgqew0Hfnol4 d7eQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=oNQizsN1; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:162e:5a6e:fd46:18b7 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id 5b1f17b1804b1-4b43ce03d95sor5115425e9.8.2026.11.04.10.01.11 for (Google Transport Security); Wed, 04 Nov 2026 10:01:12 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:162e:5a6e:fd46:18b7 as permitted sender) client-ip=2a06:5b06:b600:300:162e:5a6e:fd46:18b7; Authentication-Results: mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=oNQizsN1; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:162e:5a6e:fd46:18b7 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793815271; x=1794420071; darn=openvz.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=e9X/cVXT6P2boQJIAKpW97E0bdvBM79HZpk8zDRhhtI=; b=oNQizsN1lINxri1E/IDB4Ci+4oUTsbd9EGm5r5MKDX9U3xpTOdrtcy4nt9EZdPrynD OdsiEcNoL4ntGZIgDgfilC1QY0QfenyoWOD+MbWhGkmT96IgX61ANq50SU6ks119cwFs sVj774Z7WRH1igZekozrogmb4ibuQmGgY870v2JsPeuGgsBvD3crFGQeIU4W3D3N99OH El+OzizVbyuhYXr71XRIcZcouSZJYVKLnZXt3UIJxDRBNa2r+fYKwPPUHmb2tzPaRM84 WEpkOcyPIhYo276OywaRJ6k43bkvoGPGbvNIgiWcKc4a6kUeNgry9YNByGYHGcLAllVy 6qPA== X-Forwarded-Encrypted: i=1; AKwUvBwYULuBaoSjk+7w6dBR/k+bvtgoWF0r64SskeULSkuaeNfd7NbC9vh2rohdQQu44UrT67VLkg==@openvz.org X-Received: by 2002:a05:600c:8b04:b0:4a1:fb01:13 with SMTP id 5b1f17b1804b1-4ac17a3683bmr386265975e9.18.1793815271536; Wed, 04 Nov 2026 10:01:11 -0800 (PST) Received: from athena.sw.ru ([2a06:5b06:b600:300:162e:5a6e:fd46:18b7]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48feda20521sm5050716f8f.53.2026.11.04.10.01.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 10:01:11 -0800 (PST) From: "Denis V. Lunev" To: andrey.zhadchenko@virtuozzo.com Date: Wed, 4 Nov 2026 19:01:03 +0100 Message-ID: <20261104180105.1807820-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261104180105.1807820-1-den@openvz.org> References: <20261104180105.1807820-1-den@openvz.org> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v3 3/5] dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Denis V. Lunev qcow2_llseek_hole() starts at tgt->top and follows qcow2->lower, parsing the metadata of each image, with nothing keeping the images alive. dm core holds only the table SRCU around the call, which does not keep a target message out. merge_backward complete unlinks the merged image, waits in qcow2_inflight_ref_switch() for the qios holding refs and destroys the image, so a seek already walking it goes on with a freed struct qcow2, its md pages and its file. A SEEK_DATA scan of a large sparse image keeps the walk running long enough to hit it. Hold a per-target rw_semaphore for read over the walk, and for write while merge_backward complete unlinks and destroys the image. An inflight ref held over the walk would also do, but every inflight ref switch would then wait for the whole scan, including the one starting a backward merge with the top image paused, which stalls guest I/O for as long as the scan runs. merge_backward complete now waits for a running seek while it holds ctl_mutex, so target messages and the presuspend of the device queue behind it until the scan ends. Fixes: 412d5a4f7bf1 ("dm/dm-qcow2: add llseek_hole") https://virtuozzo.atlassian.net/browse/VSTOR-153050 Feature: dm-qcow2: block device over QCOW2 files driver Reviewed-by: Andrey Zhadchenko Reviewed-by: Konstantin Khorenko Signed-off-by: Denis V. Lunev --- drivers/md/dm-qcow2-cmd.c | 2 ++ drivers/md/dm-qcow2-map.c | 10 ++++++++-- drivers/md/dm-qcow2-target.c | 1 + drivers/md/dm-qcow2.h | 2 ++ 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-qcow2-cmd.c b/drivers/md/dm-qcow2-cmd.c index 0e2c810f657b..45c517ce0ef8 100644 --- a/drivers/md/dm-qcow2-cmd.c +++ b/drivers/md/dm-qcow2-cmd.c @@ -373,6 +373,7 @@ static int qcow2_merge_backward_complete(struct qcow2_target *tgt) if (tgt->backward_merge.state != BACKWARD_MERGE_WAIT_COMPLETION) return -EBUSY; + down_write(&tgt->seek_rwsem); qcow2 = *tgt->backward_merge.pqcow2; *tgt->backward_merge.pqcow2 = qcow2->lower; @@ -394,6 +395,7 @@ static int qcow2_merge_backward_complete(struct qcow2_target *tgt) QC_ERR(tgt->ti, "Can't unuse merged img (%d)", ret); } qcow2_destroy(qcow2); + up_write(&tgt->seek_rwsem); tgt->backward_merge.state = BACKWARD_MERGE_STOPPED; __backward_merge_update_stage(tgt, BACKWARD_MERGE_STAGE_NONE); diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c index ac4dbe0623ea..fa535d7716da 100644 --- a/drivers/md/dm-qcow2-map.c +++ b/drivers/md/dm-qcow2-map.c @@ -4844,18 +4844,24 @@ static int qcow2_llseek_hole_qio(struct qio *qio, int whence, loff_t *result) loff_t qcow2_llseek_hole(struct dm_target *ti, loff_t offset, int whence) { - struct qcow2 *qcow2 = to_qcow2_target(ti)->top; + struct qcow2_target *tgt = to_qcow2_target(ti); loff_t result = -EINVAL; + struct qcow2 *qcow2; struct qio *qio; int ret; + down_read(&tgt->seek_rwsem); + qcow2 = tgt->top; qio = alloc_seek_qio(qcow2, NULL, qcow2->hdr.size); - if (!qio) + if (!qio) { + up_read(&tgt->seek_rwsem); return -ENOMEM; + } seek_qio_set_sector(qio, to_sector(offset)); ret = qcow2_llseek_hole_qio(qio, whence, &result); + up_read(&tgt->seek_rwsem); /* In case of error remap ENXIO as it have special meaning for llseek */ if (ret < 0) return (ret == -ENXIO) ? -EINVAL : ret; diff --git a/drivers/md/dm-qcow2-target.c b/drivers/md/dm-qcow2-target.c index 4a0e5747b77a..7c572bd66e1c 100644 --- a/drivers/md/dm-qcow2-target.c +++ b/drivers/md/dm-qcow2-target.c @@ -491,6 +491,7 @@ static struct qcow2_target *alloc_qcow2_target(struct dm_target *ti) init_completion(&tgt->inflight_ref_comp); spin_lock_init(&tgt->event_lock); mutex_init(&tgt->ctl_mutex); + init_rwsem(&tgt->seek_rwsem); init_waitqueue_head(&tgt->service_wq); INIT_WORK(&tgt->event_work, qcow2_event_work); INIT_LIST_HEAD(&tgt->enospc_qios); diff --git a/drivers/md/dm-qcow2.h b/drivers/md/dm-qcow2.h index 8f10c5812a1b..ad5286b16883 100644 --- a/drivers/md/dm-qcow2.h +++ b/drivers/md/dm-qcow2.h @@ -212,6 +212,8 @@ struct qcow2_target { struct work_struct event_work; spinlock_t event_lock; struct mutex ctl_mutex; + /* Keeps merge_backward complete from freeing images a seek walks */ + struct rw_semaphore seek_rwsem; struct qcow2_backward_merge backward_merge; }; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel