From: Fiona Ebner Date: Mon, 12 Jan 2026 15:23:51 +0000 (+0100) Subject: block/mirror: check range when setting zero bitmap for sync write X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4a7b1bd18d2e1a6b3796e177ae5df9b198264a0b;p=thirdparty%2Fqemu.git block/mirror: check range when setting zero bitmap for sync write Some Proxmox users reported an occasional assertion failure [0][1] in busy VMs when using drive mirror with active mode. In particular, the failure may occur for zero writes shorter than the job granularity: > #0 0x00007b421154b507 in abort () > #1 0x00007b421154b420 in ?? () > #2 0x0000641c582e061f in bitmap_set (map=0x7b4204014e00, start=14, nr=-1) > #3 0x0000641c58062824 in do_sync_target_write (job=0x641c7e73d1e0, > method=MIRROR_METHOD_ZERO, offset=852480, bytes=4096, qiov=0x0, flags=0) > #4 0x0000641c58062250 in bdrv_mirror_top_do_write (bs=0x641c7e62e1f0, method=MIRROR_METHOD_ZERO, copy_to_target=true, offset=852480, bytes=4096, qiov=0x0, flags=0) > #5 0x0000641c58061f31 in bdrv_mirror_top_pwrite_zeroes (bs=0x641c7e62e1f0, offset=852480, bytes=4096, flags=0) The range for the dirty bitmap described by dirty_bitmap_offset and dirty_bitmap_end is narrower than the original range and in fact, dirty_bitmap_end might be smaller than dirty_bitmap_offset. There already is a check for 'dirty_bitmap_offset < dirty_bitmap_end' before resetting the dirty bitmap. Add such a check for setting the zero bitmap too, which uses the same narrower range. [0]: https://forum.proxmox.com/threads/177981/ [1]: https://bugzilla.proxmox.com/show_bug.cgi?id=7222 Cc: qemu-stable@nongnu.org Fixes: 7e277545b9 ("mirror: Skip writing zeroes when target is already zero") Signed-off-by: Fiona Ebner Message-ID: <20260112152544.261923-1-f.ebner@proxmox.com> Reviewed-by: Vladimir Sementsov-Ogievskiy Signed-off-by: Vladimir Sementsov-Ogievskiy --- diff --git a/block/mirror.c b/block/mirror.c index b344182c74..bc982cb99a 100644 --- a/block/mirror.c +++ b/block/mirror.c @@ -1514,9 +1514,12 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method, assert(!qiov); ret = blk_co_pwrite_zeroes(job->target, offset, bytes, flags); if (job->zero_bitmap && ret >= 0) { - bitmap_set(job->zero_bitmap, dirty_bitmap_offset / job->granularity, - (dirty_bitmap_end - dirty_bitmap_offset) / - job->granularity); + if (dirty_bitmap_offset < dirty_bitmap_end) { + bitmap_set(job->zero_bitmap, + dirty_bitmap_offset / job->granularity, + (dirty_bitmap_end - dirty_bitmap_offset) / + job->granularity); + } } break;