From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 0A6148045D for ; Wed, 4 Nov 2026 17:01:19 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4H01mG025154; Wed, 4 Nov 2026 20:00:02 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4H01mG025154 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="raRYr2qN" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4GxspP025131 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 4 Nov 2026 19:59:54 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4GxspP025131 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48c6a1d4034so876344f8f.0 for ; Wed, 04 Nov 2026 08:59:54 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBym25SI5Z5/MnXVehw+0rz/zJnEHcq7zA2LqDEiE2QDmPiu7gXcrJOErtbE6Ayw73V0kcoSfw==@openvz.org X-Gm-Message-State: APuU4Z8MGYqAr6rkhCWlkDFxJfy2GAlKAs2B7CyMd276HuU4scvw3l9/ JD93pXBUGBdSflMDbwF+laX3ZYlVAcotwzKDLAppNM0VLLaTQgTPA6H5bH0648bDG37EUyuyAud Wlxd8us7MiAlqYYpWNGtFNjNcj2tO1tZ09OQheCorb+O812+pGGgKKg== X-Gm-Gg: AYBFou2MK/67ERbUCFZDcHdhBrFD2Pu06XuOdljJwMgFg6fS0DyOhTtOanqIdCZYBhL 0lUrojp6SSgHKUhhT76GUmVO+V6oKRwznHp1CGVCDR+w3bItXMDvSb41JKKyG55y4MlFaFUi3DQ 5/pt1rChSrQ5NmLcrpcgNFno6n8dvobHLsWK5c5rmEbjMjk3iem+EGIxf1GftV/q8vCmAbq2tEw 4QuQQCDOZkcS0I8vleOy7yNUhLzrdvOLmiKVDwKs+CNBlAUVxLhtyUokgExPLhCe8QfzcUa6Vbo GQ1J5usggfz3r+Qwmc1E4Crzm/9XTiWK1b8bMnP0hbkEQHfM5c6mZjxU/sFoJiaxPg9Wh+0pein o9/nJAnG5IQJ36wZU X-Received: by 2002:a05:6000:4202:b0:48f:bcdf:6f83 with SMTP id ffacd0b85a97d-48fbcdf713emr8116328f8f.22.1793811593750; Wed, 04 Nov 2026 08:59:53 -0800 (PST) X-Received: by 2002:a05:6000:4202:b0:48f:bcdf:6f83 with SMTP id ffacd0b85a97d-48fbcdf713emr8116286f8f.22.1793811593256; Wed, 04 Nov 2026 08:59:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793811593; cv=none; d=google.com; s=arc-20260327; b=lU82QN9b8LZ6fBJI84r8eYThbVPdbpM6EV/0AGInCXStzvL2oHeUy3HYaP3rKVhmaN P4GTqnefbGiEFCaE+MZpju+4uVwugiXToke9yFZSRtXsVoR8FY9RzIiC1KTYPN18EW2g GIn/NfFOQrX0aQsotu9OyF8Dslw5KaBm+RCJheJviTCBLdCfgyozkmrmrShavVPERlho 3QhMP2g4sj2vmQcekFp05Gwh1F4Gqf2RDa6/Scsa3whZzy6WCgOWuhX0RRSJZAQ6aiN9 QAAHHGkXke530ejL/35FOz1jOgjvJeR08ivHvwg7FeuoTR5ITm1Hmw9+Uwy2Gq3qXwsn Yz9g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=KaVH5/Iq9gBOCVppKTuIefu9hB8E7H13q2DdXzKKzNY=; fh=wjIBJwS4A72E5Ce5VjfhniUGUVdfOyxDI2ywJwwowhw=; b=a83i2ycwrNzZZIaC+ZMGS5WuM6x3+aZtlolQnwd700Xmid1u7l5ynBK/DYqf9tzZ+n UN/CF6uhiwQ4zPMClwFkiyiC6w7c6lrza7UMnwr2BNsixYD3MfcZYlnI4Xr1PZIU0RNn fSpTmhXBCNTFdc95Qom4Kp/0vgpNx7ybEeNT4An+Qi+wbRHZ0P5CIcqfyNuBqEy4s/72 nDdE+t4gYzk2wmUDc22a7JjzMTBhWvxhxZ4LkawTiWHpKAEy0STT2IJA/LjVYc6g3uyv lHIFVxnt1/FycYOPcRy8NYxGgRfihhiFwXJHH3DxsTUYhPFNDY/Bcd3MUVLGUeEZ+M/D RRtg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=raRYr2qN; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48feee3219dsi5965355f8f.268.2026.11.04.08.59.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 08:59:53 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=raRYr2qN; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Date:From:Subject:Content-Type: MIME-Version; bh=KaVH5/Iq9gBOCVppKTuIefu9hB8E7H13q2DdXzKKzNY=; b=raRYr2qNYtzj lTmr4eAK4BwOmW0FRam9R/Vk7CdLaR0k3CSLG0/HM9vrVExubeOk6ovscKQ3QpwpFMmX7gNs3TsRM h7Xyx/Nr7vGNY3duaXMJl76f2vAilbbq0VyA1lzbh6XOlTKUy+V3+byIm4H53k84C2KbkK7vIImmE CQQILz6EqFgPskTUA6OCg5a9Ww+L8T46Y2ArXwckMtiOe2KXVj6P8OOIeyWPlArCUPmxFBStC2zfE 96yVhiQhr2RTByzZ1aR/zn+kOSPIHdh+reDbrTTBbgOaDcWZw48Z3fX7DfmoxVVDlpwX7arUPnOVJ 9KgbW221AnlEgUbaIbdsAA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOeH5-00EvRl-2I; Wed, 04 Nov 2026 17:59:51 +0100 MIME-Version: 1.0 From: Konstantin Khorenko To: "Denis V. Lunev" In-Reply-To: <20261103090813.166986-2-den@openvz.org> References: <20261103090813.166986-1-den@openvz.org> <20261103090813.166986-2-den@openvz.org> Date: Wed, 04 Nov 2026 17:59:49 +0100 Message-Id: <179381158915.2686233.14965545339589766845.b4-review@b4> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2895; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=5UAPtlYPZwsnQtOMSjcBGLTX5csTPZPj/2A/HTQ81cQ=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq62SHcpSvbK912gtidVc3v1IAw0MUpjcgMtIAj Vc4HL8DGVqJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCautkhwAKCRBRlgpH+WFc KlozD/9IPrjjfI3XttMh5aNa0DfE0E5VMQ3TjP+XHwQBmJ1voW2Ar591Eydc184Lhf0YMIZEazP irl2Nr1bJx4O21sO4lvTIFR4MUo7MA+ABiv1Ujw9GJkazxKN58zO+NYMuMqmJPR5YhautZuBV1C 1GJY2XG33KyZVTrNPH91jnh5/PZ/yVrRiKRauhX+kKczrF63RiqBzPnSbAYQzeLwLcPUyhTDZpZ HvB38dHVQa7NUM3RWO4jPfvLwi+IP5TPBPkArv1yJpgzZvbN6esyaynA0mmVmRy7Z/oOUvTL95K /92vmqKl2mRy5f060GDh/ffgulcn4nBAY7VCcnho9Gf69oIHPyLqcj+Sy8HCRKrqR3a9miifZL+ TAeyCe6UTPJseshC1+1IMBxSmN1nGk8PO3P9qgQLicOTSJTYhn+TpScMo1REaxnY8Rlc6oFmv1g 2GZv3Ko9D4NbyBmJinbcHKvDhMDJA7+CpLaxS+lqTGKTP/S7hyGjE8965Gt7W5kcdebkYDEb82C pTTnl0zh/8OY8blFOTZprQoVNw3yPgxpru9zGyBQVTtk3rStZ9pyx7cJhtEIMVgtJ7XR8xFWjBw jMPojf9Ii45L0DMIul8w7fWFJM6DQ4iMPXVXltkY388kLu9+SwAWBvMX9KfjNb9Zgiqi8KZMkhm GV35MOGtf+O8itQ== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v2 1/3] dm-qcow2: fix a failed refcount table relocation leaking md pages X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org I won't apply this version, please send v2 with the changes below. On 11/3/26 10:08, Denis V. Lunev wrote: > err_free_r2_pages: > - for (i = end; i < r2_end; i += clu_size) { > + for (i = new_md_start; i < new_md_end; i += PAGE_SIZE) { > ret = handle_md_page(qcow2, i >> PAGE_SHIFT, NULL, &md); > if (ret <= 0) > break; Item 1 of the cover letter reply: after a successful header write, do not free the new md pages in this loop. Send the gotos that follow the header write to a label after the loop that only returns -EIO, and update the "Note for a future reader" to match. This version should not go in as is: it trades one rare failure for a worse one. +------------------------+----------------------+--------------------+ | | without this patch | with this patch | +------------------------+----------------------+--------------------+ | a page allocation or | every write past the | fixed | | the header write fails | old refcount | | | during the relocation | coverage gets EIO | | | | until suspend/resume | | +------------------------+----------------------+--------------------+ | an image with 4K | WARN + EIO | use-after-free: a | | clusters and | | page still on the | | refcount_bits=64 grows | | writeback list is | | to about 511G | | freed, memory gets | | (refcount_bits=32: 2T) | | corrupted | +------------------------+----------------------+--------------------+ EIO is visible and suspend/resume cures it. Memory corruption can crash the node or silently damage someone else's data. Both cases are rare, but the second one is normal work with a valid image, no failure needed. How the second row happens: one of the gotos after the header write is reachable on a valid image, and by then this loop frees a dirty page. With 4K clusters and refcount_bits=64 the relocation at about 511G makes the new reftable fill a whole refcount group, so that group gets no refblock and the mark-used loop fails at i = pos (refcount_bits=32 gets there at about 2T). The connect loop has already dirtied the page at new_md_start and queued it for writeback. Before this patch that page leaked and the device got EIO. With the patch it is freed while still on the writeback list, and the slow writeback timer then works on freed memory. Item 6 of the cover letter reply, a separate patch: the missing refblock for the group of pos is a bug of its own, there since the driver was added. The connect loop gives a refblock only to the groups the new refblocks sit in. -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel