doge 64c1bb3bfc block: Prevent QCOW data loss from stale punch-hole ...

QCOW metadata published a fully deallocated cluster before the
caller performed the host punch-hole. Under multi-queue load, a
concurrent metadata flush could make the cluster allocatable, and
another queue could reuse it before the delayed punch ran. If reused as
an L2 table, the stale punch erased live metadata and made guest data
unreachable.

This was observed in production as confirmed guest data loss, with
allocated guest clusters becoming refcounted but unreachable from the
QCOW mapping.

Keep punch-pending clusters out of both free lists. Publish a cluster
only after the host punch succeeds, so another metadata flush is
required before reuse.

Add deterministic coverage for the cross-queue schedule and for host
operation failures.

Signed-off-by: doge <me@crackerben.com>

2026-07-23 11:58:11 +00:00

..

src

block: Prevent QCOW data loss from stale punch-hole

2026-07-23 11:58:11 +00:00

Cargo.toml

build(deps): bump the non-rust-vmm group across 2 directories with 13 updates

2026-07-10 00:53:35 +00:00