Bug 1807057 - qcow2_alloc_cluster_abort() frees preallocated zero clusters
Summary: qcow2_alloc_cluster_abort() frees preallocated zero clusters
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: qemu-kvm
Version: 8.2
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: rc
: 8.0
Assignee: Hanna Reitz
QA Contact: Xueqiang Wei
URL:
Whiteboard:
Depends On:
Blocks: 1807377
TreeView+ depends on / blocked
 
Reported: 2020-02-25 14:40 UTC by Hanna Reitz
Modified: 2020-11-04 02:54 UTC (History)
5 users (show)

Fixed In Version: qemu-kvm-4.2.0-31.module+el8.3.0+7437+4bb96e0d
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1807377 (view as bug list)
Environment:
Last Closed: 2020-11-04 02:53:03 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4676 0 None None None 2020-11-04 02:54:00 UTC

Description Hanna Reitz 2020-02-25 14:40:13 UTC
Description of problem:

qcow2_alloc_cluster_abort() frees preallocated zero clusters, even though the corresponding handle_alloc() did not allocate them.  This leads to image corruption.


Version-Release number of selected component (if applicable):

qemu-kvm-4.2.0-12.module+el8.2.0+5858+afd073bc


How reproducible:

Always


Steps to Reproduce:

Create a preallocated zero cluster, then issue a write to it while ensuring that the data write will fail:

$ cat > blkdebug.conf <<EOF
[inject-error]
event = "write_aio"
errno = "5"
immediately = "on"
once = "on"
EOF

$ qemu-img create -f qcow2 foo.qcow2 64M
$ qemu-io -c 'write 0 64k' -c 'write -z 0 64k' foo.qcow2
$ qemu-io -c 'write 0 64k' blkdebug:blkdebug.conf:foo.qcow2


Actual results:

$ qemu-img check foo.qcow2
ERROR cluster 5 refcount=0 reference=1
ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050001 refcount=0

2 errors were found on the image.
Data may be corrupted, or further writes to the image may corrupt it.
1/1024 = 0.10% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 393216


Expected results:

$ qemu-img check foo.qcow2
No errors were found on the image.
1/1024 = 0.10% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 393216


Additional info:

Fix sent upstream as “qcow2: Fix alloc_cluster_abort() for pre-existing clusters”.

Comment 2 Hanna Reitz 2020-02-26 09:01:00 UTC
Oh.  I actually meant to create this BZ for AV.  I didn’t even know this bug existed in the slow train, too, but it does indeed.

Well, then I think we should keep this one for the slow train and create a new one for the fast train, yes.

And as for:
(In reply to Max Reitz from comment #0)
> Version-Release number of selected component (if applicable):
> 
> qemu-kvm-4.2.0-12.module+el8.2.0+5858+afd073bc

So this should be qemu-kvm-2.12.0-99.module+el8.2.0+5827+8c39933c for this BZ.

Max

Comment 9 Xueqiang Wei 2020-07-23 06:35:42 UTC
Reproduced it with qemu-kvm-4.2.0-30.module+el8.3.0+7298+c26a06b8

# cat > blkdebug.conf <<EOF
[inject-error]
event = "write_aio"
errno = "5"
immediately = "on"
once = "on"
EOF

# qemu-img create -f qcow2 foo.qcow2 64M
Formatting 'foo.qcow2', fmt=qcow2 size=67108864 cluster_size=65536 lazy_refcounts=off refcount_bits=16

# qemu-io -c 'write 0 64k' -c 'write -z 0 64k' foo.qcow2
wrote 65536/65536 bytes at offset 0
64 KiB, 1 ops; 00.06 sec (1.041 MiB/sec and 16.6579 ops/sec)
wrote 65536/65536 bytes at offset 0
64 KiB, 1 ops; 00.01 sec (11.074 MiB/sec and 177.1867 ops/sec)

# qemu-io -c 'write 0 64k' blkdebug:blkdebug.conf:foo.qcow2
write failed: Input/output error

# qemu-img check foo.qcow2
ERROR cluster 5 refcount=0 reference=1
ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050001 refcount=0

2 errors were found on the image.
Data may be corrupted, or further writes to the image may corrupt it.
1/1024 = 0.10% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 393216



Retested with qemu-kvm-4.2.0-31.module+el8.3.0+7437+4bb96e0d, not hit this issue. So set status to VERIFIED.

Versions:
kernel-4.18.0-224.el8.x86_64
qemu-kvm-4.2.0-31.module+el8.3.0+7437+4bb96e0d


# qemu-img create -f qcow2 foo.qcow2 64M
Formatting 'foo.qcow2', fmt=qcow2 size=67108864 cluster_size=65536 lazy_refcounts=off refcount_bits=16

# qemu-img create -f qcow2 foo.qcow2 64M
Formatting 'foo.qcow2', fmt=qcow2 size=67108864 cluster_size=65536 lazy_refcounts=off refcount_bits=16

# qemu-io -c 'write 0 64k' -c 'write -z 0 64k' foo.qcow2
wrote 65536/65536 bytes at offset 0
64 KiB, 1 ops; 00.06 sec (1.135 MiB/sec and 18.1635 ops/sec)
wrote 65536/65536 bytes at offset 0
64 KiB, 1 ops; 00.01 sec (11.082 MiB/sec and 177.3184 ops/sec)

# qemu-io -c 'write 0 64k' blkdebug:blkdebug.conf:foo.qcow2
write failed: Input/output error

# qemu-img check foo.qcow2
No errors were found on the image.
1/1024 = 0.10% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 393216

Comment 12 errata-xmlrpc 2020-11-04 02:53:03 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4676


Note You need to log in before you can comment on or make changes to this bug.