From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4639180F25 for ; Tue, 3 Nov 2026 09:09:50 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A398XBO003109; Tue, 3 Nov 2026 12:08:34 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A398XBO003109 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=default; t=1793696917; bh=X5ex6iOfhQrCtqA2xZLS9BBRcApqRSKjfLX0nsFJ0os=; h=From:To:Date:In-Reply-To:References:Cc:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe; b=LKuAenkYlzl+d+KtLzAlz5Wphry+oQ8+nc4CmHvl5UgH9IaVbopuTpUGnvyLOWFD+ knB3CY92Z5XhUVVxG6tDQPhcazwDNm/WAKTj35oPNRqf2VeOpnKHVScWOoqaSl4U0I wN6qGZDiH9IN9HRbzQRlQFq7GUBBeMF99/15F3+j21VZWAn7RcSQeiuZsQ5xBfmMha oSpUByMyLmj15Z3UfqvgGjNQ97SqBgWvsgcAnsAq3yVr/aCtX8VIqBIJ+pUB/v1w+8 7UC7+VI0H/N2PvTE7QE8OQ80Sxbaq1rWlXkaMDxxVaBWzvTvBHBgZbo574aPsHsBF2 Z41aKyQCXXU6w== Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A398KBi003087 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 12:08:20 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A398KBi003087 Authentication-Results: mail.openvz.org; dkim=pass (2048-bit key) header.d=openvz.org header.i=@openvz.org header.b="SFPiG7ad" Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4a9d51dc486so2976565e9.1 for ; Tue, 03 Nov 2026 01:08:20 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxE9WV55nbeDq+9FrwSLyg2ADd6ZWPY/T+Je5GMYFa8DNi1DQc+Q5gfoaXNO25JJ7JdOSGyng==@openvz.org X-Gm-Message-State: APuU4Z//jlwSxI6UtgnK4cwNJMFh3oRsLSU4CzEC+5Lp+8kf61JJBYpa Rp8c9Z3Bb4TSDI30rMSlg+zqv1m6zgsiYDqMWJeOIFYXtANdOqvIk3Yu4XnGmjjJlctIRj1wl6t D0x5frXvnJzJIbo0bMikhElv6KXQDWFRSkJ5C5IkMST2WyjdaWHgoUw== X-Gm-Gg: AYBFou2PfoT2aefCjvmLyH8U0dc3g/zgAb8hQ40SQoDgD9ZkphbhqYiQnhQCqqNLfcK MQ6gUzxwTiLolWh8jpJkUaJHQydwjBSkRw4MxlNv2C0zGrEyXAJObYA9aeJtQA8J37E+qk5ISPU t6G9g1YwPT/V+Qt5xZ0H5UzP8SnZbA7/Qc8g5t9hBvObvsQYiaUylqRgSwPOXDEOXIXizeaCuKs mlhx8RDMKa1ualTeDzFqsuJW+UVQPfMreISwCHeofJtIoqduU/NSkigbOSnrniQ6uf1BnXDhKWo hswyc6RHbw== X-Received: by 2002:a05:600c:1d11:b0:4a1:c27d:e1a8 with SMTP id 5b1f17b1804b1-4ac174712admr293372825e9.10.1793696900290; Tue, 03 Nov 2026 01:08:20 -0800 (PST) X-Received: by 2002:a05:600c:1d11:b0:4a1:c27d:e1a8 with SMTP id 5b1f17b1804b1-4ac174712admr293372075e9.10.1793696899620; Tue, 03 Nov 2026 01:08:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793696899; cv=none; d=google.com; s=arc-20260327; b=onwab18V7OFU+9FovwsvX+WE+x0ORdWTmS2BP0wuJY3xenK6YFW1RRdhzCnc3MbdRH UrToLPh75NLak9bTIKmpfqTET4WZts9QGZ6LicTNqdr41ORA0ejG5BBsBFxX+sLTT8Ls Fp8CV99SR/v/JGGnps2e75/DIeQvx6C8j4RWJiHwmkH8IneHqNhGQHUZy5CplZxdMz/h z9PtF4tetqVnjpzvOzdeAz3+QlGXLIXTL8LkwAvz7dQF+A/Myn0IK2FD8z2xi6uAEaAR 7W5yiA+QMN2BbJ5KKJ4DKmmpbDrAxL5wwbN7pYvxQ8ODv4n8BiWRkRhtQNGuXg5vAEcV LfzA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=0qRei0qI/WD+5v/zZsDwJG08m5t9tpoUMpe6+Z6pDgQ=; fh=kMzgXK919SyMHo4N1CsC+AEVVWWSfpvr9XHCDGigkVU=; b=IPUm0J+Ow5QGVYA4nZWlBmRKs92TnHdVg9mJfEBJWl+skEK8Mmq8Tkzx+QAuL5rSVQ TplrHyS75sFw2zc7PUWkJ0bMZsiKRqNupZaiEfBT8nHk++PhaP93zsaeXOW3swnqlqih MQH/tWenYnpV97w6pmVNV7yTLbwK/yRgFRVF4U6DHFif7gWpp76RBhm95QQ0Kde4RiY9 9lXtfjNBGHEYxatMonY9zW2hclp/vP11j9slCWxMgqTPGQHFFLx6iH/FHN/iOkvXX6vr QbNogQ9iuTqj4dexfNfmy+0QejGZGLIv7NdUfc/bQ7xf8xBfckVC+0A+laubUVchElTw Q4xw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=SFPiG7ad; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id 5b1f17b1804b1-4b2abd92814sor4309755e9.8.2026.11.03.01.08.19 for (Google Transport Security); Tue, 03 Nov 2026 01:08:19 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) client-ip=2a06:5b06:b600:300:c789:8bc5:fa8e:d502; Authentication-Results: mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=SFPiG7ad; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:c789:8bc5:fa8e:d502 as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793696899; x=1794301699; darn=openvz.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0qRei0qI/WD+5v/zZsDwJG08m5t9tpoUMpe6+Z6pDgQ=; b=SFPiG7adPoRWT8UPiLowS2rvlSfe0eRHrzPWP99AQZ1uW5DXZjyPS5uYMhpo+N7b// oFZ1HTm72bQeAXyucQ1w1sRrstpidauCLgFZ1K5J3E+PyJhqWsY4PMKPtJRNp1zEwhtK 9CwzRVugC0alwGD9ylFTc9K6SjxqO+MVlWuOzawfRVgRMDITwOgLUE53HeAe7dYuLQPd guIWwfcorXxsrZveDinMvU4nl/nrkUurfPyDjrJoEvFhePc6SKvQj4csfe4A/vKVxq// 3rUhbJ2j9DCPRTwQHuChNw/OGX30hchOoZvXtHsXyGlEG3B5YnrMBvrgqmrLnz/W+2vn vgRQ== X-Forwarded-Encrypted: i=1; AKwUvBwkE72lBf9yL+bZwZ/08xBIL+0dZ0ZZGYpYPWQN924WUrBOhE+I45OnJwVhl7/vpy1ae24ZaA==@openvz.org X-Received: by 2002:a05:600c:19d3:b0:4a2:526b:d40f with SMTP id 5b1f17b1804b1-4ac1209eafcmr286600235e9.0.1793696899074; Tue, 03 Nov 2026 01:08:19 -0800 (PST) Received: from athena.sw.ru ([2a06:5b06:b600:300:c789:8bc5:fa8e:d502]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4b2a96fc933sm45453365e9.11.2026.11.03.01.08.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 01:08:18 -0800 (PST) From: "Denis V. Lunev" To: andrey.zhadchenko@virtuozzo.com Date: Tue, 3 Nov 2026 10:08:13 +0100 Message-ID: <20261103090813.166986-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261103090813.166986-1-den@openvz.org> References: <20261103090813.166986-1-den@openvz.org> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2 3/3] dm-qcow2: fix SEEK_HOLE/SEEK_DATA using an image freed by a merge X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Denis V. Lunev qcow2_llseek_hole() starts at tgt->top and follows qcow2->lower, parsing the metadata of each image, with nothing keeping the images alive. dm core holds only the table SRCU around the call, which does not keep a target message out. merge_backward complete unlinks the merged image, waits in qcow2_inflight_ref_switch() for the qios holding refs and destroys the image, so a seek already walking it goes on with a freed struct qcow2, its md pages and its file. A SEEK_DATA scan of a large sparse image keeps the walk running long enough to hit it. Hold a per-target rw_semaphore for read over the walk, and for write while merge_backward complete unlinks and destroys the image. An inflight ref held over the walk would also do, but every inflight ref switch would then wait for the whole scan, including the one starting a backward merge with the top image paused, which stalls guest I/O for as long as the scan runs. Fixes: 412d5a4f7bf1 ("dm/dm-qcow2: add llseek_hole") https://virtuozzo.atlassian.net/browse/VSTOR-153050 Feature: dm-qcow2: block device over QCOW2 files driver Signed-off-by: Denis V. Lunev --- drivers/md/dm-qcow2-cmd.c | 2 ++ drivers/md/dm-qcow2-map.c | 10 ++++++++-- drivers/md/dm-qcow2-target.c | 1 + drivers/md/dm-qcow2.h | 2 ++ 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-qcow2-cmd.c b/drivers/md/dm-qcow2-cmd.c index cb28cf6456df..d9a6c823b817 100644 --- a/drivers/md/dm-qcow2-cmd.c +++ b/drivers/md/dm-qcow2-cmd.c @@ -373,6 +373,7 @@ static int qcow2_merge_backward_complete(struct qcow2_target *tgt) if (tgt->backward_merge.state != BACKWARD_MERGE_WAIT_COMPLETION) return -EBUSY; + down_write(&tgt->seek_rwsem); qcow2 = *tgt->backward_merge.pqcow2; *tgt->backward_merge.pqcow2 = qcow2->lower; @@ -394,6 +395,7 @@ static int qcow2_merge_backward_complete(struct qcow2_target *tgt) QC_ERR(tgt->ti, "Can't unuse merged img (%d)", ret); } qcow2_destroy(qcow2); + up_write(&tgt->seek_rwsem); tgt->backward_merge.state = BACKWARD_MERGE_STOPPED; __backward_merge_update_stage(tgt, BACKWARD_MERGE_STAGE_NONE); diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c index 8ab7cb472560..b180d8ecf7b4 100644 --- a/drivers/md/dm-qcow2-map.c +++ b/drivers/md/dm-qcow2-map.c @@ -4841,18 +4841,24 @@ static int qcow2_llseek_hole_qio(struct qio *qio, int whence, loff_t *result) loff_t qcow2_llseek_hole(struct dm_target *ti, loff_t offset, int whence) { - struct qcow2 *qcow2 = to_qcow2_target(ti)->top; + struct qcow2_target *tgt = to_qcow2_target(ti); loff_t result = -EINVAL; + struct qcow2 *qcow2; struct qio *qio; int ret; + down_read(&tgt->seek_rwsem); + qcow2 = tgt->top; qio = alloc_seek_qio(qcow2, NULL, qcow2->hdr.size); - if (!qio) + if (!qio) { + up_read(&tgt->seek_rwsem); return -ENOMEM; + } seek_qio_set_sector(qio, to_sector(offset)); ret = qcow2_llseek_hole_qio(qio, whence, &result); + up_read(&tgt->seek_rwsem); /* In case of error remap ENXIO as it have special meaning for llseek */ if (ret < 0) return (ret == -ENXIO) ? -EINVAL : ret; diff --git a/drivers/md/dm-qcow2-target.c b/drivers/md/dm-qcow2-target.c index be09615eb8e2..343957730022 100644 --- a/drivers/md/dm-qcow2-target.c +++ b/drivers/md/dm-qcow2-target.c @@ -491,6 +491,7 @@ static struct qcow2_target *alloc_qcow2_target(struct dm_target *ti) init_completion(&tgt->inflight_ref_comp); spin_lock_init(&tgt->event_lock); mutex_init(&tgt->ctl_mutex); + init_rwsem(&tgt->seek_rwsem); init_waitqueue_head(&tgt->service_wq); INIT_WORK(&tgt->event_work, qcow2_event_work); INIT_LIST_HEAD(&tgt->enospc_qios); diff --git a/drivers/md/dm-qcow2.h b/drivers/md/dm-qcow2.h index d9b8c38e093f..de685300cb48 100644 --- a/drivers/md/dm-qcow2.h +++ b/drivers/md/dm-qcow2.h @@ -212,6 +212,8 @@ struct qcow2_target { struct work_struct event_work; spinlock_t event_lock; struct mutex ctl_mutex; + /* Keeps merge_backward complete from freeing images a seek walks */ + struct rw_semaphore seek_rwsem; struct qcow2_backward_merge backward_merge; }; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel