Thank you for your contribution! Sashiko AI review found 1 potential issue to consider: - [Medium] dm-qcow2: unpinned fast-path reads can hit a freed and reused cluster --
commit d4a94f4cb8fd390d1180cc72ba95c9cab302fcdc Author: Andrey Zhadchenko <[email protected]> dm-qcow2: implement per-qio fast processing This commit tries to process each qio right after it is split, in the per-qio work. Qios that still need metadata work go back onto the deferred list for the main kwork. > diff --git a/drivers/md/dm-qcow2-map.c b/drivers/md/dm-qcow2-map.c > index 496fbcc61348..fb2a1c7c4211 100644 > --- a/drivers/md/dm-qcow2-map.c > +++ b/drivers/md/dm-qcow2-map.c > @@ -4817,9 +4817,18 @@ static void handle_cleanup_mask(struct qio *qio) > } > } > > +static void qio_try_fast(struct qio *qio, struct list_head *deferred_qios) > +{ > + list_del(&qio->link); > + > + if (process_one_qio(qio->qcow2, qio, true)) > + list_add_tail(&qio->link, deferred_qios); > +} > + [Severity: Medium] As reported by Konstantin Khorenko on v2 [1], can a fast-path read hit a cluster that has been freed and reused? qio_try_fast() runs process_one_qio() in parallel with the main kwork. For a read, parse_metadata() takes the data cluster position from the L2 entry and then drops md_pages_lock. It does not pin the cluster, because inc_writers() is only called for writes and partial discards. process_read_qio() then calls perform_rw_mapped(..., false) against that stale position, with no revalidation. If the fast worker stalls between the parse and the submit, the main kwork can discard the cluster, write back the L2 entry and free the cluster. It can then hand the cluster to another allocation. The read then returns data belonging to a different guest offset. If another consumer reuses the cluster, this also leaks that consumer's data. The commit message documents this and defers the fix to VSTOR-154659. The race still ships with this patch, and nothing later in the series adds read pinning. [1] https://lore.kernel.org/r/179433339615.3573054.12995587619826112869.b4-review@b4 -- Sashiko AI review ยท https://sashiko.vzint.dev/#/patchset/[email protected]?part=5 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
