[Devel] [PATCH hci-8.1 v2 0/3] dm-qcow2: keep images of a read-only table unmodified

[Devel] [PATCH hci-8.1 v2 0/3] dm-qcow2: keep images of a read-only table unmodified

[Alexander Ivanov]

A read-only dm-qcow2 table does not protect its images. Writes to the
device pass through bio_check_ro() with a warning and allocate clusters
in the top image, the unaligned tail of an O_RDWR top image is padded
on .ctr and .preresume, and merge_backward modifies the lower image.
Since the header is not updated for a read-only table, persistent
bitmaps stay marked consistent while the data under them changes.

Patch 1 makes an image writable only if both its file and the table
are writable. Patch 2 fails writes to a read-only table. Patch 3 keeps
the bitmaps autoclear bit clear if it is already clear in the image,
so that a later writable open does not revalidate stale bitmaps.

v2:
- patch 1: describe the tail padding and the discard and merge paths
  correctly; point the EOF read comment at qcow2_parse_header()
- patch 2: drop the comment on the read-only check
- patch 3: drop the comment on the autoclear check; add a Fixes tag

https://virtuozzo.atlassian.net/browse/VSTOR-138887

Alexander Ivanov (3):
  drivers/md/dm-qcow2: treat images of a read-only table as read-only
  drivers/md/dm-qcow2: fail writes to a read-only table
  drivers/md/dm-qcow2: do not revalidate inconsistent persistent bitmaps

 drivers/md/dm-qcow2-map.c    | 10 ++++++----
 drivers/md/dm-qcow2-target.c | 10 ++++++----
 drivers/md/dm-qcow2.h        |  3 ++-
 3 files changed, 14 insertions(+), 9 deletions(-)

-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v2 1/3] drivers/md/dm-qcow2: treat images of a read-only table as read-only

[Alexander Ivanov]

Whether an image may be modified is decided by the mode of its file
only. Userspace may pass an O_RDWR top image to a read-only table, and
then dm-qcow2 pads the unaligned image tail on .ctr and .preresume and
considers the image writable on the discard and merge paths.

merge_backward is also allowed on a read-only table if the lower image
is opened for write. qcow2_set_image_file_features() checks the table
mode and skips the lower image, so the merge writes to it without the
dirty bit and without clearing the bitmaps autoclear bit. Enabled
persistent bitmaps of the lower image are left marked consistent
although the image data changed.

Consider an image writable only if both its file and the table are
writable, and use this check for the header update, the tail padding
and the short read near EOF as well. merge_backward on a read-only
table now fails with -EACCES.

https://virtuozzo.atlassian.net/browse/VSTOR-138887
Feature: dm-qcow2: block device over QCOW2 files driver

Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-qcow2-map.c    | 6 ++----
 drivers/md/dm-qcow2-target.c | 6 ++----
 drivers/md/dm-qcow2.h        | 3 ++-
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c
index 78ee7cf5e881..bc317c8db3a6 100644
--- a/drivers/md/dm-qcow2-map.c
+++ b/drivers/md/dm-qcow2-map.c
@@ -1470,16 +1470,14 @@ static void md_page_read_complete(struct qio *qio)
 	struct md_page *md = qio->ext->md;
 	struct qcow2 *qcow2 = qio->qcow2;
 	int ret = qio->ret;
-	mode_t mode;
 
 	BUG_ON(qvec->bvec[0].bv_page != md->page);
 
 	if (unlikely(ret != PAGE_SIZE && ret > 0)) {
-		/* Read near EOF? See qcow2_attach_file() */
+		/* Read near EOF? See qcow2_parse_header() */
 		loff_t pos = (md->id << PAGE_SHIFT) + ret;
 
-		mode = qcow2->file->f_mode;
-		if (pos == qcow2->file_size && !(mode & FMODE_WRITE)) {
+		if (pos == qcow2->file_size && !qcow2_file_is_writable(qcow2)) {
 			qcow2_zero_fill_page_from(md->page, ret);
 			ret = PAGE_SIZE;
 		}
diff --git a/drivers/md/dm-qcow2-target.c b/drivers/md/dm-qcow2-target.c
index be09615eb8e2..2d1e5d4e1b3a 100644
--- a/drivers/md/dm-qcow2-target.c
+++ b/drivers/md/dm-qcow2-target.c
@@ -623,13 +623,11 @@ int qcow2_set_image_file_features(struct qcow2 *qcow2, bool dirty)
 	u64 dirty_mask = cpu_to_be64(INCOMPATIBLE_FEATURES_DIRTY_BIT);
 	struct QCowHeader *raw_hdr;
 	struct md_page *md;
-	bool is_ro;
 
 	if (qcow2->hdr.version ==  2)
 		return 0;
 
-	is_ro = !(dm_table_get_mode(qcow2->tgt->ti->table) & FMODE_WRITE);
-	if (is_ro)
+	if (!qcow2_file_is_writable(qcow2))
 		return 0;
 
 	md = qcow2_md_page_find(qcow2, 0);
@@ -840,7 +838,7 @@ static int qcow2_parse_header(struct dm_target *ti, struct qcow2 *qcow2,
 	int ret;
 
 	qcow2->file_size = i_size_read(file_inode(file));
-	if ((file->f_mode & FMODE_WRITE) && (qcow2->file_size & ~PAGE_MASK)) {
+	if (qcow2_file_is_writable(qcow2) && (qcow2->file_size & ~PAGE_MASK)) {
 		new_size = PAGE_ALIGN(qcow2->file_size);
 		ret = qcow2_truncate_safe(file, new_size);
 		if (ret) {
diff --git a/drivers/md/dm-qcow2.h b/drivers/md/dm-qcow2.h
index d9b8c38e093f..8f10c5812a1b 100644
--- a/drivers/md/dm-qcow2.h
+++ b/drivers/md/dm-qcow2.h
@@ -462,7 +462,8 @@ static inline bool qcow2_wants_check(struct qcow2_target *tgt)
 
 static inline bool qcow2_file_is_writable(struct qcow2 *qcow2)
 {
-	return qcow2->file->f_mode & FMODE_WRITE;
+	return (qcow2->file->f_mode & FMODE_WRITE) &&
+	       (dm_table_get_mode(qcow2->tgt->ti->table) & BLK_OPEN_WRITE);
 }
 
 static inline void remap_to_clu(struct qcow2 *qcow2, struct qio *qio, loff_t clu_pos)
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 1/3] drivers/md/dm-qcow2: treat images of a read-only table as read-only

[no-reply]

> Whether an image may be modified is decided by the mode of its file
> only. Userspace may pass an O_RDWR top image to a read-only table, and
> then dm-qcow2 pads the unaligned image tail on .ctr and .preresume and
> considers the image writable on the discard and merge paths.
> 
> merge_backward is also allowed on a read-only table if the lower image
> is opened for write. qcow2_set_image_file_features() checks the table
> mode and skips the lower image, so the merge writes to it without the
> dirty bit and without clearing the bitmaps autoclear bit. Enabled
> persistent bitmaps of the lower image are left marked consistent
> although the image data changed.
> 
> Consider an image writable only if both its file and the table are
> writable, and use this check for the header update, the tail padding
> and the short read near EOF as well. merge_backward on a read-only
> table now fails with -EACCES.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-138887
> Feature: dm-qcow2: block device over QCOW2 files driver
> 
> Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261029144358.3384569-1-alexander.ivanov@virtuozzo.com?part=1


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 1/3] drivers/md/dm-qcow2: treat images of a read-only table as read-only

[Konstantin Khorenko]

Applying with this fix on my side:

- Reviewed-by: Andrey Zhadchenko, from the v1 thread.

On 10/29/26 15:43, Alexander Ivanov wrote:
> Consider an image writable only if both its file and the table are
> writable, and use this check for the header update, the tail padding
> and the short read near EOF as well. merge_backward on a read-only
> table now fails with -EACCES.

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v2 2/3] drivers/md/dm-qcow2: fail writes to a read-only table

[Alexander Ivanov]

bio_check_ro() only warns about a write to a read-only disk and lets it
through. dm-qcow2 then allocates clusters in the top image although
the table is read-only. The header is not updated for a read-only
table, so enabled persistent bitmaps stay marked consistent while the
image data changes under them.

Kill write requests in .clone_and_map when the table is read-only.

https://virtuozzo.atlassian.net/browse/VSTOR-138887
Feature: dm-qcow2: block device over QCOW2 files driver

Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-qcow2-map.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c
index bc317c8db3a6..1c269a78ad35 100644
--- a/drivers/md/dm-qcow2-map.c
+++ b/drivers/md/dm-qcow2-map.c
@@ -4506,6 +4506,10 @@ int qcow2_clone_and_map(struct dm_target *ti, struct request *rq,
 	struct qcow2_rq *qrq;
 	struct qio *qio;
 
+	if (op_is_write(req_op(rq)) &&
+	    !(dm_table_get_mode(ti->table) & BLK_OPEN_WRITE))
+		return DM_MAPIO_KILL;
+
 	qrq = mempool_alloc(tgt->qrq_pool, GFP_ATOMIC);
 	if (!qrq)
 		return DM_MAPIO_KILL;
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 2/3] drivers/md/dm-qcow2: fail writes to a read-only table

[no-reply]

> bio_check_ro() only warns about a write to a read-only disk and lets it
> through. dm-qcow2 then allocates clusters in the top image although
> the table is read-only. The header is not updated for a read-only
> table, so enabled persistent bitmaps stay marked consistent while the
> image data changes under them.
> 
> Kill write requests in .clone_and_map when the table is read-only.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-138887
> Feature: dm-qcow2: block device over QCOW2 files driver
> 
> Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261029144358.3384569-1-alexander.ivanov@virtuozzo.com?part=2


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 2/3] drivers/md/dm-qcow2: fail writes to a read-only table

[Konstantin Khorenko]

Applying with this fix on my side:

- Reviewed-by: Andrey Zhadchenko, from the v1 thread.

On 10/29/26 15:43, Alexander Ivanov wrote:
> Kill write requests in .clone_and_map when the table is read-only.

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 v2 3/3] drivers/md/dm-qcow2: do not revalidate inconsistent persistent bitmaps

[Alexander Ivanov]

qcow2_check_convert_hdr() ignores the autoclear features stored in the
image, and qcow2_parse_bitmap_ext() sets the bitmaps bit whenever no
bitmap has the auto flag. If the bit was already clear on disk, a
writable open sets it again and marks the bitmaps extension consistent.
The qcow2 spec requires to treat such an extension as inconsistent,
since a program without bitmap support might have modified the image.

Keep the bitmaps bit only if it is set in the image.

https://virtuozzo.atlassian.net/browse/VSTOR-138887
Feature: dm-qcow2: block device over QCOW2 files driver

Fixes: f913aa3f7a1d4 ("dm-qcow2: parse bitmap extension")
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-qcow2-target.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/dm-qcow2-target.c b/drivers/md/dm-qcow2-target.c
index 2d1e5d4e1b3a..4a0e5747b77a 100644
--- a/drivers/md/dm-qcow2-target.c
+++ b/drivers/md/dm-qcow2-target.c
@@ -835,6 +835,7 @@ static int qcow2_parse_header(struct dm_target *ti, struct qcow2 *qcow2,
 	struct file *file = qcow2->file;
 	loff_t ext_start, ext_end;
 	struct md_page *md;
+	u64 raw_autoclear;
 	int ret;
 
 	qcow2->file_size = i_size_read(file_inode(file));
@@ -865,6 +866,7 @@ static int qcow2_parse_header(struct dm_target *ti, struct qcow2 *qcow2,
 		max_len = upper->hdr.size;
 	}
 	ret = qcow2_check_convert_hdr(ti, raw_hdr, hdr, min_len, max_len);
+	raw_autoclear = be64_to_cpu(raw_hdr->autoclear_features);
 	kunmap(md->page);
 	if (ret < 0)
 		goto out;
@@ -914,6 +916,8 @@ static int qcow2_parse_header(struct dm_target *ti, struct qcow2 *qcow2,
 			goto out;
 		}
 	}
+	if (!(raw_autoclear & QCOW2_AUTOCLEAR_BITMAPS))
+		hdr->autoclear_features &= ~QCOW2_AUTOCLEAR_BITMAPS;
 	ret = 0;
 out:
 	return ret;
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 3/3] drivers/md/dm-qcow2: do not revalidate inconsistent persistent bitmaps

[no-reply]

> qcow2_check_convert_hdr() ignores the autoclear features stored in the
> image, and qcow2_parse_bitmap_ext() sets the bitmaps bit whenever no
> bitmap has the auto flag. If the bit was already clear on disk, a
> writable open sets it again and marks the bitmaps extension consistent.
> The qcow2 spec requires to treat such an extension as inconsistent,
> since a program without bitmap support might have modified the image.
> 
> Keep the bitmaps bit only if it is set in the image.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-138887
> Feature: dm-qcow2: block device over QCOW2 files driver
> 
> Fixes: f913aa3f7a1d4 ("dm-qcow2: parse bitmap extension")
> Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261029144358.3384569-1-alexander.ivanov@virtuozzo.com?part=3


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 3/3] drivers/md/dm-qcow2: do not revalidate inconsistent persistent bitmaps

[Konstantin Khorenko]

Applying with these fixes on my side:

- Reviewed-by: Andrey Zhadchenko, from the v1 thread.
- "requires to treat" -> "requires treating".

On 10/29/26 15:43, Alexander Ivanov wrote:
> The qcow2 spec requires to treat such an extension as inconsistent,
> since a program without bitmap support might have modified the image.

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 0/3] dm-qcow2: keep images of a read-only table unmodified

[Konstantin Khorenko]

Applying the series with these fixes on my side:

- Reviewed-by: Andrey Zhadchenko on all three patches, from the v1
  thread.
- patch 3: "requires to treat" -> "requires treating".

On 10/29/26 15:43, Alexander Ivanov wrote:
> A read-only dm-qcow2 table does not protect its images. Writes to the
> device pass through bio_check_ro() with a warning and allocate clusters
> in the top image, the unaligned tail of an O_RDWR top image is padded
> on .ctr and .preresume, and merge_backward modifies the lower image.

- Please create one more task, like VSTOR-152393..152395, and fix it
  separately: a data read of a read-only image with an unaligned tail
  never completes.

md_page_read_complete() zero-fills a short read near EOF, so metadata
pages are fine. data_rw_complete() is not: it advances past the short
read and resubmits, the next read starts at EOF and returns 0,
WARN_ON_ONCE() fires and the qio is resubmitted without progress. This
is old for O_RDONLY images and now also covers an O_RDWR image on a
read-only table, which patch 1 stops padding. qemu never leaves such a
tail, so it takes an externally truncated image. The fix is a zero fill
in data_rw_complete() like the metadata one.

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2 0/3] dm-qcow2: keep images of a read-only table unmodified

[Konstantin Khorenko]

On Thu, 29 Oct 2026 15:43:55 +0100, Alexander Ivanov wrote:
> dm-qcow2: keep images of a read-only table unmodified
> 
> A read-only dm-qcow2 table does not protect its images. Writes to the
> device pass through bio_check_ro() with a warning and allocate clusters
> in the top image, the unaligned tail of an O_RDWR top image is padded
> on .ctr and .preresume, and merge_backward modifies the lower image.
> Since the header is not updated for a read-only table, persistent
> bitmaps stay marked consistent while the data under them changes.
> 
> [...]

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.17.vz10, thanks!

[1/3] drivers/md/dm-qcow2: treat images of a read-only table as read-only
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/59e7fee12e85
[2/3] drivers/md/dm-qcow2: fail writes to a read-only table
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/409d7e697578
[3/3] drivers/md/dm-qcow2: do not revalidate inconsistent persistent bitmaps
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/8be5099f6e51

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel