@samitouri / QOSamiQemu / commits / 1d47eb6898

qcow2: Fix data loss on zero write with detect-zeroes=unmap

Commit b8bfb1478d ("qcow2: Fix corruption on discard during write with COW") added a wait_for_dependencies() at the start of qcow2_subcluster_zeroize(). That fixes the inconsistency it set out to fix, but turns the lock-protected pre-check in the caller, qcow2_co_pwrite_zeroes(), into a stale one: the wait yields s->lock, so an in-flight allocating write whose QCowL2Meta is already on s->cluster_allocs (but whose L2 entry is not yet linked) gets to link its entry during the yield. When the zeroize wakes, the cluster is now NORMAL, and with BDRV_REQ_MAY_UNMAP the free path in zero_in_l2_slice() unmaps the just-written cluster, silently dropping the data write's payload. This is reachable with detect-zeroes=unmap (the default for VirtIO disks with discard on in Proxmox VE), under which the block layer auto-promotes all-zero buffers to BDRV_REQ_ZERO_WRITE | BDRV_REQ_MAY_UNMAP. A memory-constrained Debian guest running 'apt full-upgrade' on such a disk reproduces it as random SIGSEGVs: swapped-out code pages come back as zero. Wait for in-flight dependencies before the lock-protected check in qcow2_co_pwrite_zeroes(). If a write linked its L2 entry during the wait, the type check now fails and the block layer falls back to a bounce-buffered zero write that only touches the requested subrange, preserving the racing write's data. Promote wait_for_dependencies() to qcow2_wait_for_dependencies() so qcow2.c can call it. Fixes: b8bfb1478d ("qcow2: Fix corruption on discard during write with COW") Cc: qemu-stable@nongnu.org Tested-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> Message-ID: <20260522151318.238064-1-t.lamprecht@proxmox.com> [kwolf: Reverted unnecessary change to 'nr' assignment] Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Thomas Lamprecht committed May 22, 2026 at 17:13 UTC 1d47eb68983577a4e06fe1c165d90e128b191b86

5 files changed +49 -6

block/qcow2-cluster.c

+5 -5

@@ -1474,9 +1474,9 @@ static int coroutine_fn handle_dependencies(BlockDriverState *bs,

1474 return 0;

1475 }

1476

1477 -static void coroutine_mixed_fn wait_for_dependencies(BlockDriverState *bs,

1478 - uint64_t guest_offset,

1479 - uint64_t bytes)

1477 +void coroutine_mixed_fn qcow2_wait_for_dependencies(BlockDriverState *bs,

1478 + uint64_t guest_offset,

1479 + uint64_t bytes)

1480 {

1481 BDRVQcow2State *s = bs->opaque;

1482 QCowL2Meta *m = NULL;

@@ -2035,7 +2035,7 @@ int qcow2_cluster_discard(BlockDriverState *bs, uint64_t offset,

2035 * We don't need to allocate a QCowL2Meta for the discard operation because

2036 * s->lock is held for the duration of the whole operation.

2037 */

2038 - wait_for_dependencies(bs, offset, bytes);

2038 + qcow2_wait_for_dependencies(bs, offset, bytes);

2039

2040 /* Caller must pass aligned values, except at image end */

2041 assert(QEMU_IS_ALIGNED(offset, s->cluster_size));

@@ -2204,7 +2204,7 @@ int coroutine_fn qcow2_subcluster_zeroize(BlockDriverState *bs, uint64_t offset,

2204 * We don't need to allocate a QCowL2Meta for the zeroize operation because

2205 * s->lock is held for the duration of the whole operation.

2206 */

2207 - wait_for_dependencies(bs, offset, bytes);

2207 + qcow2_wait_for_dependencies(bs, offset, bytes);

2208

2209 /* If we have to stay in sync with an external data file, zero out

2210 * s->data_file first. */

block/qcow2.c

+7 -1

@@ -4234,10 +4234,16 @@ qcow2_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,

4234 }

4235

4236 qemu_co_mutex_lock(&s->lock);

4237 - /* We can have new write after previous check */

4237 offset -= head;

4238 bytes = s->subcluster_size;

4239 nr = s->subcluster_size;

4240 + /*

4241 + * Wait for in-flight allocating writes first: otherwise the type

4242 + * check below could pass on UNALLOCATED while a yet-to-link_l2 write

4243 + * completes during qcow2_subcluster_zeroize()'s own wait, letting the

4244 + * resumed MAY_UNMAP discard the just-written data.

4245 + */

4246 + qcow2_wait_for_dependencies(bs, offset, bytes);

4247 ret = qcow2_get_host_offset(bs, offset, &nr, &off, &type);

4248 if (ret < 0 ||

4249 (type != QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN &&

block/qcow2.h

@@ -966,6 +966,10 @@ int coroutine_fn GRAPH_RDLOCK

966 qcow2_subcluster_zeroize(BlockDriverState *bs, uint64_t offset, uint64_t bytes,

967 int flags);

968

969 +void coroutine_mixed_fn

970 +qcow2_wait_for_dependencies(BlockDriverState *bs, uint64_t guest_offset,

971 + uint64_t bytes);

972 +

973 int GRAPH_RDLOCK

974 qcow2_expand_zero_clusters(BlockDriverState *bs,

975 BlockDriverAmendStatusCB *status_cb,

tests/qemu-iotests/046

+23

@@ -226,6 +226,26 @@ aio_write -z 0x140000 0x10000

226 resume A

227 aio_flush

228 EOF

229 +

230 +# Start an allocating write to a previously unallocated cluster and, before

231 +# its L2 update is linked, issue a concurrent sub-cluster zero write with

232 +# MAY_UNMAP that targets a disjoint range within the same cluster. The zero

233 +# write's head/tail are zero (cluster is unallocated), so qcow2_co_pwrite_zeroes

234 +# would expand it to the full subcluster. Without waiting for dependencies

235 +# before the zero write's "unallocated" type check, that check passes,

236 +# qcow2_subcluster_zeroize then yields in wait_for_dependencies, the allocating

237 +# write links its L2 entry, and the resumed zeroize unmaps the cluster -

238 +# silently discarding the just-written data. Waiting first makes the zero write

239 +# fall back to a bounce-buffered real write, which only touches its own

240 +# subrange.

241 +cat <<EOF

242 +break write_aio A

243 +aio_write -P 180 0x200000 0x4000

244 +wait_break A

245 +aio_write -z -u 0x204000 0x4000

246 +resume A

247 +aio_flush

248 +EOF

249 }

250

251 overlay_io | $QEMU_IO blkdebug::"$TEST_IMG" | _filter_qemu_io |\

@@ -310,6 +330,9 @@ verify_io()

330 echo read -P 0 0x120000 0x10000

331 echo read -P 0 0x130000 0x10000

332 echo read -P 0 0x140000 0x10000

333 +

334 + echo read -P 180 0x200000 0x4000

335 + echo read -P 0 0x204000 0xc000

336 }

337

338 verify_io | $QEMU_IO "$TEST_IMG" | _filter_qemu_io

tests/qemu-iotests/046.out

+10

@@ -169,6 +169,12 @@ wrote XXX/XXX bytes at offset XXX

169 XXX KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

170 wrote XXX/XXX bytes at offset XXX

171 XXX KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

172 +blkdebug: Suspended request 'A'

173 +blkdebug: Resuming request 'A'

174 +wrote XXX/XXX bytes at offset XXX

175 +XXX KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

176 +wrote XXX/XXX bytes at offset XXX

177 +XXX KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

178

179 == Verify image content ==

180 read 65536/65536 bytes at offset 0

@@ -275,5 +281,9 @@ read 65536/65536 bytes at offset 1245184

281 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

282 read 65536/65536 bytes at offset 1310720

283 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

284 +read 16384/16384 bytes at offset 2097152

285 +16 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

286 +read 49152/49152 bytes at offset 2113536

287 +48 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

288 No errors were found on the image.

289 *** done