[PATCH qemu-server 1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure

[PATCH qemu-server 1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure

[Michael Köppl]

The state volume was allocated before the running instance was queried
for its machine type, CPU argument and network MTUs. Those queries can
fail (e.g. the 'query-machines' QMP command, which can run into a
timeout while QEMU's is busy [0]).

The helper is called from __snapshot_prepare() before write_config(), so
the config never records the snapshot, snapshot_create() dies before it
gets to its cleanup path. Such a failure leaves behind the just
allocated volume.

Query the running instance first, which makes the allocation the last
step of the function that can fail.

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=8030

Signed-off-by: Michael Köppl <m.koeppl@proxmox.com>
---
Tested this pretty much as described in the Bugzilla entry, but using a
Perl script to connect to the QMP socket instead of socat.

 src/PVE/QemuConfig.pm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/PVE/QemuConfig.pm b/src/PVE/QemuConfig.pm
index 26f0fda2..2ef6c075 100644
--- a/src/PVE/QemuConfig.pm
+++ b/src/PVE/QemuConfig.pm
@@ -238,8 +238,6 @@ sub __snapshot_save_vmstate {
     my $name = "vm-$vmid-state-$snapname";
     $name .= ".raw" if $scfg->{path}; # add filename extension for file base storage
 
-    my $statefile =
-        PVE::Storage::vdisk_alloc($storecfg, $target, $vmid, 'raw', $name, $size * 1024);
     my $runningmachine = PVE::QemuServer::Machine::get_current_qemu_machine($vmid);
 
     # get current QEMU -cpu argument to ensure consistency of custom CPU models
@@ -249,6 +247,11 @@ sub __snapshot_save_vmstate {
 
     my $nets_host_mtu = PVE::QemuServer::Network::get_nets_host_mtu($vmid, $conf);
 
+    # allocate only after querying the running instance, nothing below can fail, so a failed
+    # query cannot leave an orphaned state volume behind
+    my $statefile =
+        PVE::Storage::vdisk_alloc($storecfg, $target, $vmid, 'raw', $name, $size * 1024);
+
     if (!$suspend) {
         $conf = $conf->{snapshots}->{$snapname};
     }
-- 
2.47.3

Re: [PATCH qemu-server 1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure

[Jakob Klocker]

Confirmed that an orphaned volume is left behind when the QMP
socket is occupied, causing the snapshot to fail because
`query-machines` times out. After applying the patch, no orphaned
volume remains, which fixes the reported bug.

Not adding additional cleanup, but moving the disk allocation below
the setup functions that can fail is IMO the cleanest solution here.

Consider this:
Reviewed-by: Jakob Klocker <j.klocker@proxmox.com>
Tested-by: Jakob Klocker <j.klocker@proxmox.com>
On Mon Sep 14, 2026 at 4:05 PM CEST, Michael Köppl wrote:
> The state volume was allocated before the running instance was queried
> for its machine type, CPU argument and network MTUs. Those queries can
> fail (e.g. the 'query-machines' QMP command, which can run into a
> timeout while QEMU's is busy [0]).
>
> The helper is called from __snapshot_prepare() before write_config(), so
> the config never records the snapshot, snapshot_create() dies before it
> gets to its cleanup path. Such a failure leaves behind the just
> allocated volume.
>
> Query the running instance first, which makes the allocation the last
> step of the function that can fail.
>
> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=8030
>
> Signed-off-by: Michael Köppl <m.koeppl@proxmox.com>
> [SNIP]

Re: [PATCH qemu-server 1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure

[Elias Huhsovitz]

Sensible change! The state information should be allocated as late as
possible on disk.

Tested using the same methodology as the bug reporter. The state-file
was not orphaned and after releasing the QMP socket, operations and
snapshots continued working as normal.

Therefore:

Reviewed-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
Tested-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>

On Mon Sep 14, 2026 at 4:05 PM CEST, Michael Köppl wrote:
> The state volume was allocated before the running instance was queried
> for its machine type, CPU argument and network MTUs. Those queries can
> fail (e.g. the 'query-machines' QMP command, which can run into a
> timeout while QEMU's is busy [0]).
>
> The helper is called from __snapshot_prepare() before write_config(), so
> the config never records the snapshot, snapshot_create() dies before it
> gets to its cleanup path. Such a failure leaves behind the just
> allocated volume.
>
> Query the running instance first, which makes the allocation the last
> step of the function that can fail.
>
> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=8030
>
> Signed-off-by: Michael Köppl <m.koeppl@proxmox.com>
> ---
> Tested this pretty much as described in the Bugzilla entry, but using a
> Perl script to connect to the QMP socket instead of socat.
>
>  src/PVE/QemuConfig.pm | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/src/PVE/QemuConfig.pm b/src/PVE/QemuConfig.pm
> index 26f0fda2..2ef6c075 100644
> --- a/src/PVE/QemuConfig.pm
> +++ b/src/PVE/QemuConfig.pm
> @@ -238,8 +238,6 @@ sub __snapshot_save_vmstate {
>      my $name = "vm-$vmid-state-$snapname";
>      $name .= ".raw" if $scfg->{path}; # add filename extension for file base storage
>  
> -    my $statefile =
> -        PVE::Storage::vdisk_alloc($storecfg, $target, $vmid, 'raw', $name, $size * 1024);
>      my $runningmachine = PVE::QemuServer::Machine::get_current_qemu_machine($vmid);
>  
>      # get current QEMU -cpu argument to ensure consistency of custom CPU models
> @@ -249,6 +247,11 @@ sub __snapshot_save_vmstate {
>  
>      my $nets_host_mtu = PVE::QemuServer::Network::get_nets_host_mtu($vmid, $conf);
>  
> +    # allocate only after querying the running instance, nothing below can fail, so a failed
> +    # query cannot leave an orphaned state volume behind
> +    my $statefile =
> +        PVE::Storage::vdisk_alloc($storecfg, $target, $vmid, 'raw', $name, $size * 1024);
> +
>      if (!$suspend) {
>          $conf = $conf->{snapshots}->{$snapname};
>      }

applied: [PATCH qemu-server 1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure

[Fiona Ebner]

On Mon, 14 Sep 2026 16:05:47 +0200, Michael Köppl wrote:
> The state volume was allocated before the running instance was queried
> for its machine type, CPU argument and network MTUs. Those queries can
> fail (e.g. the 'query-machines' QMP command, which can run into a
> timeout while QEMU's is busy [0]).
> 
> The helper is called from __snapshot_prepare() before write_config(), so
> the config never records the snapshot, snapshot_create() dies before it
> gets to its cleanup path. Such a failure leaves behind the just
> allocated volume.
> 
> [...]

Applied, thanks!

[1/1] fix #8030: snapshot: avoid orphaned vmstate volume on failure
      commit: 1db755c9bb3233d92770b8d9dcd8f3792380daec