Anatol Belski 2d86fc8422 block: qcow: Set corrupt bit on known inconsistencies ...

Set the QCOW2 corrupt bit when internal inconsistencies are detected
that indicate image metadata may be corrupted:

- Decompression decode failure, meaning compressed cluster data is
  invalid
- Decompression size mismatch, where decompressed data doesn't match
  expected cluster size
- Partial write after decompression, where L2 table was updated but
  data cluster not fully written, leaving metadata inconsistent
- Invalid refcount index, where cluster address is outside valid
  refcount table range, indicating a corrupted L2 entry
- Dirty L2 with zero L1 address, where L2 table is marked dirty but
  L1 has no address for it

Note: Marking decompression failures as corrupt is more conservative
than QEMU, which returns EIO without setting the corrupt bit. This is
debatable since corrupted compressed data doesn't necessarily indicate
metadata corruption, but it provides a stronger safety guarantee by
preventing further writes to potentially damaged images.

Once set, the image can only be opened read-only until repaired with
qemu-img check -r.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>

2026-01-28 15:30:33 +00:00

..

src

block: qcow: Set corrupt bit on known inconsistencies

2026-01-28 15:30:33 +00:00

Cargo.toml

block: qcow: Validate incompatible feature bits

2026-01-23 18:58:56 +00:00