From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH qemu 2/2] more stable fixes for QEMU 11.1
Date: Mon, 12 Oct 2026 12:51:43 +0200 [thread overview]
Message-ID: <20261012105232.146528-3-f.ebner@proxmox.com> (raw)
In-Reply-To: <20261012105232.146528-1-f.ebner@proxmox.com>
Pick up a corruption fix for the block layer, fixes to improve
flush error reporting upon close and for qemu-img, a fix for iterating
block nodes, and a hardening for USB emulation.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
...-Limit-DMA-transfers-to-plain-memory.patch | 85 ++
...corruption-from-broken-RMW-atomicity.patch | 124 +++
...-redundant-bdrv_wait_serialising_req.patch | 71 ++
...rv_next-skipping-monitor-owned-nodes.patch | 118 +++
...-cases-for-failing-flush-after-qemu-.patch | 88 ++
.../0010-iotests.py-add-filter_qemu.patch | 34 +
...report-flush-error-during-bdrv_close.patch | 763 ++++++++++++++++++
...ert-flush-target-image-after-copying.patch | 99 +++
...return-success-on-info-without-snaps.patch | 4 +-
...dd-add-osize-and-read-from-to-stdin-.patch | 12 +-
...E-Up-qemu-img-dd-add-isize-parameter.patch | 14 +-
...PVE-Up-qemu-img-dd-add-n-skip_create.patch | 10 +-
...-add-l-option-for-loading-a-snapshot.patch | 14 +-
...-Backup-add-backup-dump-block-driver.patch | 2 +-
debian/patches/series | 8 +
15 files changed, 1418 insertions(+), 28 deletions(-)
create mode 100644 debian/patches/extra/0005-hw-usb-hcd-xhci-Limit-DMA-transfers-to-plain-memory.patch
create mode 100644 debian/patches/extra/0006-block-Fix-corruption-from-broken-RMW-atomicity.patch
create mode 100644 debian/patches/extra/0007-block-Remove-now-redundant-bdrv_wait_serialising_req.patch
create mode 100644 debian/patches/extra/0008-block-fix-bdrv_next-skipping-monitor-owned-nodes.patch
create mode 100644 debian/patches/extra/0009-iotests-add-test-cases-for-failing-flush-after-qemu-.patch
create mode 100644 debian/patches/extra/0010-iotests.py-add-filter_qemu.patch
create mode 100644 debian/patches/extra/0011-block-report-flush-error-during-bdrv_close.patch
create mode 100644 debian/patches/extra/0012-qemu-img-convert-flush-target-image-after-copying.patch
diff --git a/debian/patches/extra/0005-hw-usb-hcd-xhci-Limit-DMA-transfers-to-plain-memory.patch b/debian/patches/extra/0005-hw-usb-hcd-xhci-Limit-DMA-transfers-to-plain-memory.patch
new file mode 100644
index 0000000000..d30c86d8b2
--- /dev/null
+++ b/debian/patches/extra/0005-hw-usb-hcd-xhci-Limit-DMA-transfers-to-plain-memory.patch
@@ -0,0 +1,85 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Tue, 15 Sep 2026 14:32:42 +0200
+Subject: [PATCH] hw/usb/hcd-xhci: Limit DMA transfers to plain memory
+
+XHCI is a complex controller, involving lots of descriptors that
+are written and read via DMA transfers. As some recent bugs like
+https://gitlab.com/qemu-project/qemu/-/work_items/3926 revealed,
+this can sometimes be exploited from the guest side to crash or
+stall QEMU.
+
+The code currently does DMA writes with the MEMTXATTRS_UNSPECIFIED
+attribute, i.e. the controller is allowed to write to other MMIO
+regions, too. However, in normal operation, this should not be
+necessary, all descriptors should reside in normal memory. So let's
+decrease the attack surface a little bit and limit the DMA writes
+to normal memory here.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-ID: <20260915123242.549150-1-thuth@redhat.com>
+(cherry picked from commit 89e653b77369ad2d3e579139b1fa2567daa86a79)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/usb/hcd-xhci.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index 624ce4ee75..376bc00264 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -518,6 +518,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
+ int i;
+ uint32_t tmp[5];
+ uint32_t n = len / sizeof(uint32_t);
++ const MemTxAttrs memtx_attrs = { .memory = true };
+
+ assert((len % sizeof(uint32_t)) == 0);
+ assert(n <= ARRAY_SIZE(tmp));
+@@ -525,8 +526,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
+ for (i = 0; i < n; i++) {
+ tmp[i] = cpu_to_le32(buf[i]);
+ }
+- if (dma_memory_write(xhci->as, addr, tmp, len,
+- MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
++ if (dma_memory_write(xhci->as, addr, tmp, len, memtx_attrs) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
+ __func__);
+ xhci_die(xhci);
+@@ -613,6 +613,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
+ XHCIInterrupter *intr = &xhci->intr[v];
+ XHCITRB ev_trb;
+ dma_addr_t addr;
++ const MemTxAttrs memtx_attrs = { .memory = true };
+
+ ev_trb.parameter = cpu_to_le64(event->ptr);
+ ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
+@@ -629,7 +630,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
+
+ addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
+ if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE,
+- MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
++ memtx_attrs) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
+ __func__);
+ xhci_die(xhci);
+@@ -2440,6 +2441,7 @@ static void xhci_detach_slot(XHCIState *xhci, USBPort *uport)
+ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
+ {
+ dma_addr_t ctx;
++ const MemTxAttrs memtx_attrs = { .memory = true };
+
+ DPRINTF("xhci_get_port_bandwidth()\n");
+
+@@ -2448,9 +2450,9 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
+ DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx);
+
+ /* TODO: actually implement real values here. This is 80% for all ports. */
+- if (stb_dma(xhci->as, ctx, 0, MEMTXATTRS_UNSPECIFIED) != MEMTX_OK ||
++ if (stb_dma(xhci->as, ctx, 0, memtx_attrs) != MEMTX_OK ||
+ dma_memory_set(xhci->as, ctx + 1, 80, xhci->numports,
+- MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
++ memtx_attrs) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n",
+ __func__);
+ return CC_TRB_ERROR;
diff --git a/debian/patches/extra/0006-block-Fix-corruption-from-broken-RMW-atomicity.patch b/debian/patches/extra/0006-block-Fix-corruption-from-broken-RMW-atomicity.patch
new file mode 100644
index 0000000000..d34d79bb26
--- /dev/null
+++ b/debian/patches/extra/0006-block-Fix-corruption-from-broken-RMW-atomicity.patch
@@ -0,0 +1,124 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Fri, 2 Oct 2026 15:21:34 +0200
+Subject: [PATCH] block: Fix corruption from broken RMW atomicity
+
+When emulating 512 byte sector devices on top of 4k native host storage,
+QEMU performs a read-modify-write cycle for misaligned write requests.
+These requests are marked as serialising so that any other writes to the
+same 4k block will have to wait and can't overwrite the block in the
+middle, which would make the RMW write back stale data.
+
+In principle, this mechanism works fine, but there is a race condition
+in the implementation: bdrv_find_conflicting_request() assumes that
+req->waiting_for == NULL means that the request is the active owner of
+the data blocks it touches and everyone else has to wait for this
+request. However, there is a window between tracked_request_begin() and
+bdrv_wait_serialising_requests_locked() where any new request has
+req->waiting_for == NULL even if it conflicts with an already running
+serialising request. So at this point, we have seemingly two active
+owners at the same time until the new request checks for conflicts.
+
+For a third request coming in, this isn't a problem, it just might wait
+for a little longer than necessary. However, if the original RMW request
+calls bdrv_wait_serialising_requests_locked() again (which it does in
+bdrv_aligned_pwritev() -> bdrv_co_write_req_prepare() before writing
+back the RMW buffer), it will now wait on the other request that snuck
+in, which is fatal and makes the RMW buffer stale. This scenario causes
+data corruption.
+
+Fix this by checking for conflicts already in tracked_request_begin()
+while holding the bs->reqs_lock mutex, so that the race window is closed
+and req->waiting_for == NULL really has the intended meaning.
+
+For good measure, add an active_owner boolean that is set when a request
+is marked serialising and has completed waiting for other requests, and
+assert that it is not set when waiting for another request, so that in
+the case of another bug, we'd crash instead of causing data corruption.
+
+Cc: qemu-stable@nongnu.org
+Buglink: https://redhat.atlassian.net/browse/RHEL-272836
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20261002132135.93345-2-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 0bd5a1b3d60cca595e19bb73eec83307259be671)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ block/io.c | 23 +++++++++++++++++++++++
+ include/block/block_int-common.h | 1 +
+ 2 files changed, 24 insertions(+)
+
+diff --git a/block/io.c b/block/io.c
+index a916b236c3..bd562d472f 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -50,6 +50,9 @@
+ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
+ int64_t offset, int64_t bytes, BdrvRequestFlags flags);
+
++static void coroutine_fn
++bdrv_wait_serialising_requests_locked(BdrvTrackedRequest *self);
++
+ static void GRAPH_RDLOCK
+ bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore)
+ {
+@@ -616,6 +619,7 @@ static void coroutine_fn tracked_request_begin(BdrvTrackedRequest *req,
+ .type = type,
+ .co = qemu_coroutine_self(),
+ .serialising = false,
++ .active_owner = false,
+ .overlap_offset = offset,
+ .overlap_bytes = bytes,
+ };
+@@ -624,6 +628,15 @@ static void coroutine_fn tracked_request_begin(BdrvTrackedRequest *req,
+
+ qemu_mutex_lock(&bs->reqs_lock);
+ QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);
++
++ /*
++ * Set .waiting_for while we're holding the lock, otherwise we'd open a race
++ * window where another request in the middle of its RMW cycle starts
++ * waiting for us, leading to potential data corruption if this request
++ * overwrites a block the RMW request has already read.
++ */
++ bdrv_wait_serialising_requests_locked(req);
++
+ qemu_mutex_unlock(&bs->reqs_lock);
+ }
+
+@@ -684,6 +697,15 @@ bdrv_wait_serialising_requests_locked(BdrvTrackedRequest *self)
+ BdrvTrackedRequest *req;
+
+ while ((req = bdrv_find_conflicting_request(self))) {
++ /*
++ * If this request is the active owner of the data blocks it accesses,
++ * no other conflicting request may exist; other requests have to wait
++ * for this one, not the other way around. If this condition is
++ * violated, RMW operations may be interrupted in the middle, operate on
++ * stale data and introduce data corruption.
++ */
++ assert(!self->active_owner);
++
+ self->waiting_for = req;
+ qemu_co_queue_wait(&req->wait_queue, &self->bs->reqs_lock);
+ self->waiting_for = NULL;
+@@ -803,6 +825,7 @@ void coroutine_fn bdrv_make_request_serialising(BdrvTrackedRequest *req,
+
+ tracked_request_set_serialising(req, align);
+ bdrv_wait_serialising_requests_locked(req);
++ req->active_owner = true;
+
+ qemu_mutex_unlock(&req->bs->reqs_lock);
+ }
+diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
+index 147c08155f..46428b034d 100644
+--- a/include/block/block_int-common.h
++++ b/include/block/block_int-common.h
+@@ -80,6 +80,7 @@ typedef struct BdrvTrackedRequest {
+ enum BdrvTrackedRequestType type;
+
+ bool serialising;
++ bool active_owner;
+ int64_t overlap_offset;
+ int64_t overlap_bytes;
+
diff --git a/debian/patches/extra/0007-block-Remove-now-redundant-bdrv_wait_serialising_req.patch b/debian/patches/extra/0007-block-Remove-now-redundant-bdrv_wait_serialising_req.patch
new file mode 100644
index 0000000000..c85c3beac5
--- /dev/null
+++ b/debian/patches/extra/0007-block-Remove-now-redundant-bdrv_wait_serialising_req.patch
@@ -0,0 +1,71 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Fri, 2 Oct 2026 15:21:35 +0200
+Subject: [PATCH] block: Remove now redundant bdrv_wait_serialising_requests()
+ calls
+
+All callers of bdrv_wait_serialising_requests() (as opposed to
+bdrv_wait_serialising_requests_locked()) are just duplicating the check
+that tracked_request_begin() already performs now. After removing them,
+bdrv_wait_serialising_requests() has no callers left and can go as well.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20261002132135.93345-3-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit cf4f672c11d663f87462cfd99a92124b30804e99)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ block/io.c | 19 -------------------
+ 1 file changed, 19 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index bd562d472f..1c05dd106d 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -802,20 +802,6 @@ void bdrv_dec_in_flight(BlockDriverState *bs)
+ bdrv_wakeup(bs);
+ }
+
+-static void coroutine_fn
+-bdrv_wait_serialising_requests(BdrvTrackedRequest *self)
+-{
+- BlockDriverState *bs = self->bs;
+-
+- if (!qatomic_read(&bs->serialising_in_flight)) {
+- return;
+- }
+-
+- qemu_mutex_lock(&bs->reqs_lock);
+- bdrv_wait_serialising_requests_locked(self);
+- qemu_mutex_unlock(&bs->reqs_lock);
+-}
+-
+ void coroutine_fn bdrv_make_request_serialising(BdrvTrackedRequest *req,
+ uint64_t align)
+ {
+@@ -1383,8 +1369,6 @@ bdrv_aligned_preadv(BdrvChild *child, BdrvTrackedRequest *req,
+ * it ensures that the CoR read and write operations are atomic and
+ * guest writes cannot interleave between them. */
+ bdrv_make_request_serialising(req, bdrv_get_cluster_size(bs));
+- } else {
+- bdrv_wait_serialising_requests(req);
+ }
+
+ if (flags & BDRV_REQ_COPY_ON_READ) {
+@@ -2021,8 +2005,6 @@ bdrv_co_write_req_prepare(BdrvChild *child, int64_t offset, int64_t bytes,
+ }
+
+ bdrv_wait_serialising_requests_locked(req);
+- } else {
+- bdrv_wait_serialising_requests(req);
+ }
+
+ assert(req->overlap_offset <= offset);
+@@ -3530,7 +3512,6 @@ static int coroutine_fn GRAPH_RDLOCK bdrv_co_copy_range_internal(
+
+ /* BDRV_REQ_SERIALISING is only for write operation */
+ assert(!(read_flags & BDRV_REQ_SERIALISING));
+- bdrv_wait_serialising_requests(&req);
+
+ ret = src->bs->drv->bdrv_co_copy_range_from(src->bs,
+ src, src_offset,
diff --git a/debian/patches/extra/0008-block-fix-bdrv_next-skipping-monitor-owned-nodes.patch b/debian/patches/extra/0008-block-fix-bdrv_next-skipping-monitor-owned-nodes.patch
new file mode 100644
index 0000000000..09bc3f3d7d
--- /dev/null
+++ b/debian/patches/extra/0008-block-fix-bdrv_next-skipping-monitor-owned-nodes.patch
@@ -0,0 +1,118 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Denis V. Lunev" <den@openvz.org>
+Date: Sat, 29 Aug 2026 00:20:05 +0200
+Subject: [PATCH] block: fix bdrv_next() skipping monitor-owned nodes
+
+it->bs is the cursor into monitor_bdrv_states for the second phase of
+bdrv_next(), so it has to be NULL when that phase starts. Commit
+f6d38c9f6d made the first phase store the node it returns there, to
+unreference the right one when the graph changes underneath. The cursor
+is now left pointing at the last BlockBackend root, so the second phase
+resumes from there instead of from the head of the list and never
+returns a node added before it.
+
+A skipped node drops out of the vm_stop and migration handover paths:
+not flushed, not inactivated, not snapshotted. bdrv_inactivate_all()
+still reports success, so the node keeps its image lock and the
+migration target cannot open the image. Only detached nodes are hit in
+practice, as these callers also recurse into children.
+
+Reset the cursor when the second phase starts. old_bs is taken at the
+top of the function, so f6d38c9f6d keeps working.
+
+Cc: qemu-stable@nongnu.org
+Fixes: f6d38c9f6d ("block-backend: fix edge case in bdrv_next() where BDS associated to BB changes")
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+Cc: Fiona Ebner <f.ebner@proxmox.com>
+Cc: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20260828222005.2888213-1-den@openvz.org>
+Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
+Tested-by: Fiona Ebner <f.ebner@proxmox.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 8daaf8d3b1c5f2ef98e526e036277083bc5fe34b)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ block/block-backend.c | 1 +
+ tests/qemu-iotests/tests/inactive-node-nbd | 16 ++++++++++++++++
+ tests/qemu-iotests/tests/inactive-node-nbd.out | 8 ++++++++
+ 3 files changed, 25 insertions(+)
+
+diff --git a/block/block-backend.c b/block/block-backend.c
+index 37ba7e9fc4..55497c4551 100644
+--- a/block/block-backend.c
++++ b/block/block-backend.c
+@@ -625,6 +625,7 @@ BlockDriverState *bdrv_next(BdrvNextIterator *it)
+ return bs;
+ }
+ it->phase = BDRV_NEXT_MONITOR_OWNED;
++ it->bs = NULL;
+ }
+
+ /* Then return the monitor-owned BDSes without a BB attached. Ignore all
+diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotests/tests/inactive-node-nbd
+index 664157bfd0..ef876ae6be 100755
+--- a/tests/qemu-iotests/tests/inactive-node-nbd
++++ b/tests/qemu-iotests/tests/inactive-node-nbd
+@@ -47,6 +47,7 @@ def node_is_active(_vm, node_name):
+ return node['active']
+
+ with iotests.FilePath('disk.img') as path, \
++ iotests.FilePath('detached.img') as detached_path, \
+ iotests.FilePath('snap.qcow2') as snap_path, \
+ iotests.FilePath('snap2.qcow2') as snap2_path, \
+ iotests.FilePath('target.img') as target_path, \
+@@ -58,6 +59,7 @@ with iotests.FilePath('disk.img') as path, \
+ iotests.log('Preparing disk...')
+ iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size)
+ iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size)
++ iotests.qemu_img_create('-f', iotests.imgfmt, detached_path, img_size)
+
+ iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfmt,
+ snap_path)
+@@ -68,6 +70,9 @@ with iotests.FilePath('disk.img') as path, \
+ vm.add_blockdev(f'file,node-name=disk-file,filename={path}')
+ vm.add_blockdev(f'{iotests.imgfmt},file=disk-file,node-name=disk-fmt,'
+ 'active=off')
++ vm.add_blockdev(f'file,node-name=detached-file,filename={detached_path}')
++ vm.add_blockdev(f'{iotests.imgfmt},file=detached-file,'
++ 'node-name=detached-fmt')
+ vm.add_blockdev(f'file,node-name=target-file,filename={target_path}')
+ vm.add_blockdev(f'{iotests.imgfmt},file=target-file,node-name=target-fmt')
+ vm.add_blockdev(f'file,node-name=snap-file,filename={snap_path}')
+@@ -297,6 +302,17 @@ with iotests.FilePath('disk.img') as path, \
+ iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
+ iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt'))
+
++ iotests.log('\n=== Inactivating all nodes at once ===')
++
++ # detached-fmt has no parent and no BlockBackend, so nothing can reach it
++ # by recursion. It is only inactivated if bdrv_next() actually returns it.
++ vm.qmp_log('stop')
++ vm.qmp_log('blockdev-set-active', active=False)
++
++ iotests.log('detached-fmt active: %s' % node_is_active(vm, 'detached-fmt'))
++ iotests.log('detached-file active: %s'
++ % node_is_active(vm, 'detached-file'))
++
+ iotests.log('\nShutting down...')
+ vm.shutdown()
+ log = vm.get_log()
+diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-iotests/tests/inactive-node-nbd.out
+index a458b4fc05..48451dc0c5 100644
+--- a/tests/qemu-iotests/tests/inactive-node-nbd.out
++++ b/tests/qemu-iotests/tests/inactive-node-nbd.out
+@@ -235,5 +235,13 @@ snap-fmt active: True
+ snap2-fmt active: True
+ target-fmt active: True
+
++=== Inactivating all nodes at once ===
++{"execute": "stop", "arguments": {}}
++{"return": {}}
++{"execute": "blockdev-set-active", "arguments": {"active": false}}
++{"return": {}}
++detached-fmt active: False
++detached-file active: False
++
+ Shutting down...
+
diff --git a/debian/patches/extra/0009-iotests-add-test-cases-for-failing-flush-after-qemu-.patch b/debian/patches/extra/0009-iotests-add-test-cases-for-failing-flush-after-qemu-.patch
new file mode 100644
index 0000000000..b25ebdf1b9
--- /dev/null
+++ b/debian/patches/extra/0009-iotests-add-test-cases-for-failing-flush-after-qemu-.patch
@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Thu, 8 Oct 2026 08:11:42 -0500
+Subject: [PATCH] iotests: add test cases for failing flush after qemu-img
+ convert
+
+In preparation to add more checks in the following commits and show
+how the behavior changes.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Message-ID: <20260930132140.2342574-2-f.ebner@proxmox.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20261008131216.2437896-20-eblake@redhat.com
+(pick from qemu-devel)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ tests/qemu-iotests/122 | 33 +++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/122.out | 14 ++++++++++++++
+ 2 files changed, 47 insertions(+)
+
+diff --git a/tests/qemu-iotests/122 b/tests/qemu-iotests/122
+index be0f6b79e5..488649f1bd 100755
+--- a/tests/qemu-iotests/122
++++ b/tests/qemu-iotests/122
+@@ -334,6 +334,39 @@ echo
+ $QEMU_IMG convert -O $IMGFMT -o preallocation=metadata -n \
+ "$TEST_IMG" "$TEST_IMG".orig && echo "unexpected success"
+
++echo
++echo "=== failing flush after convert with default ('unsafe') cache mode ==="
++echo
++
++TEST_IMG="$TEST_IMG".orig _make_test_img 1M
++TEST_IMG="$TEST_IMG" _make_test_img 1M
++
++$QEMU_IO -c "write -P 42 0 1M" "$TEST_IMG".orig | _filter_qemu_io
++
++target_fails_flush="json:{
++ 'driver': '$IMGFMT',
++ 'file': {
++ 'driver': 'blkdebug',
++ 'inject-error': [{
++ 'event': 'flush_to_disk'
++ }],
++ 'image': {
++ 'driver': 'file',
++ 'filename': '$TEST_IMG'
++ }
++ }
++}"
++
++$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush"
++echo "qemu-img convert exited with status $?"
++
++echo
++echo "=== failing flush after convert with 'writeback' cache mode ==="
++echo
++
++$QEMU_IMG convert -t writeback -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush"
++echo "qemu-img convert exited with status $?"
++
+ # success, all done
+ echo '*** done'
+ rm -f $seq.full
+diff --git a/tests/qemu-iotests/122.out b/tests/qemu-iotests/122.out
+index 6a1aa3fe2b..f3e28f33bc 100644
+--- a/tests/qemu-iotests/122.out
++++ b/tests/qemu-iotests/122.out
+@@ -256,4 +256,18 @@ Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=67108864
+ === -n incompatible with -o ===
+
+ qemu-img: -o has no effect when skipping image creation
++
++=== failing flush after convert with default ('unsafe') cache mode ===
++
++Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=1048576
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576
++wrote 1048576/1048576 bytes at offset 0
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++qemu-img convert exited with status 0
++
++=== failing flush after convert with 'writeback' cache mode ===
++
++qemu-img: Failed to flush the L2 table cache: Input/output error
++qemu-img: Failed to flush the refcount block cache: Input/output error
++qemu-img convert exited with status 0
+ *** done
diff --git a/debian/patches/extra/0010-iotests.py-add-filter_qemu.patch b/debian/patches/extra/0010-iotests.py-add-filter_qemu.patch
new file mode 100644
index 0000000000..73f0cfab1f
--- /dev/null
+++ b/debian/patches/extra/0010-iotests.py-add-filter_qemu.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Thu, 8 Oct 2026 08:11:43 -0500
+Subject: [PATCH] iotests.py: add filter_qemu()
+
+Add a filter_qemu() helper function for replacing the QEMU program
+name with 'QEMU_PROG' in test's log messages.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Message-ID: <20260930132140.2342574-3-f.ebner@proxmox.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20261008131216.2437896-21-eblake@redhat.com
+(pick from qemu-devel)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ tests/qemu-iotests/iotests.py | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
+index 072be80e07..ed41f88d2a 100644
+--- a/tests/qemu-iotests/iotests.py
++++ b/tests/qemu-iotests/iotests.py
+@@ -596,6 +596,10 @@ def filter_qemu_io(msg):
+ return qemu_io_re.sub("X ops; XX:XX:XX.X "
+ "(XXX YYY/sec and XXX ops/sec)", msg)
+
++qemu_re = re.compile(r"%s" % os.path.basename(qemu_prog))
++def filter_qemu(msg):
++ return qemu_re.sub("QEMU_PROG", msg)
++
+ chown_re = re.compile(r"chown [0-9]+:[0-9]+")
+ def filter_chown(msg):
+ return chown_re.sub("chown UID:GID", msg)
diff --git a/debian/patches/extra/0011-block-report-flush-error-during-bdrv_close.patch b/debian/patches/extra/0011-block-report-flush-error-during-bdrv_close.patch
new file mode 100644
index 0000000000..0d1d3d3df0
--- /dev/null
+++ b/debian/patches/extra/0011-block-report-flush-error-during-bdrv_close.patch
@@ -0,0 +1,763 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Thu, 8 Oct 2026 08:11:44 -0500
+Subject: [PATCH] block: report flush error during bdrv_close()
+
+Flush during bdrv_close() was introduced back in 2012 in commit
+80ccf93b88 ("qemu-img: let 'qemu-img convert' flush data"). However, a
+failing flush was quietly ignored [0]. Report the error instead, since
+this could mean that the image contents are not as expected.
+
+Adapt the iotests accordingly. For all tests except '080' and
+'qsd-migrate' the failures come from blkdebug configurations. For
+'080', the failures are also directly expected, because of invalid L1
+table size and offset. For the 'qsd-migrate' test, the error happens,
+because the QSD node which is attached via NBD to the source VM was
+inactivated.
+
+[0]: Note that the errors reported for qcow2 come from
+qcow2_inactivate() which is only called as part of
+bs->drv->bdrv_close() after bdrv_flush(). In particular, adding
+> 'once': 'on'
+to the blkdebug driver in the relevant test case in the 122 iotest
+shows that the failure can be silent in case of qcow2 too.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Message-ID: <20260930132140.2342574-4-f.ebner@proxmox.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20261008131216.2437896-22-eblake@redhat.com
+(pick from qemu-devel)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ block.c | 13 +++-
+ tests/qemu-iotests/026 | 10 +--
+ tests/qemu-iotests/026.out | 84 ++++++++++++++++++++++
+ tests/qemu-iotests/071 | 2 +-
+ tests/qemu-iotests/071.out | 2 +
+ tests/qemu-iotests/080.out | 2 +
+ tests/qemu-iotests/098.out | 4 ++
+ tests/qemu-iotests/122 | 8 +--
+ tests/qemu-iotests/122.out | 2 +
+ tests/qemu-iotests/244 | 2 +-
+ tests/qemu-iotests/244.out | 1 +
+ tests/qemu-iotests/tests/file-io-error | 2 +-
+ tests/qemu-iotests/tests/file-io-error.out | 2 +
+ tests/qemu-iotests/tests/qsd-migrate | 5 +-
+ tests/qemu-iotests/tests/qsd-migrate.out | 1 +
+ 15 files changed, 125 insertions(+), 15 deletions(-)
+
+diff --git a/block.c b/block.c
+index f0a6042e61..c05ad01f25 100644
+--- a/block.c
++++ b/block.c
+@@ -5162,12 +5162,23 @@ static void GRAPH_UNLOCKED bdrv_close(BlockDriverState *bs)
+ {
+ BdrvAioNotifier *ban, *ban_next;
+ BdrvChild *child, *next;
++ int ret;
+
+ GLOBAL_STATE_CODE();
+ assert(!bs->refcnt);
+
+ bdrv_drained_begin(bs); /* complete I/O */
+- bdrv_flush(bs);
++ ret = bdrv_flush(bs);
++ if (ret < 0) {
++ const char *name;
++ if (bs->filename[0]) {
++ name = bs->filename;
++ } else {
++ name = bdrv_get_node_name(bs);
++ }
++ error_report("Failed flush for '%s' during close: %s", name,
++ strerror(-ret));
++ }
+ bdrv_drain(bs); /* in case flush left pending I/O */
+
+ if (bs->drv) {
+diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026
+index d37e266dad..88cb4dd934 100755
+--- a/tests/qemu-iotests/026
++++ b/tests/qemu-iotests/026
+@@ -103,13 +103,13 @@ if [ "$event" == "l2_update" ]; then
+ $QEMU_IO -c "write $vmstate 0 512" "$TEST_IMG" > /dev/null 2>&1
+ fi
+
+-$QEMU_IO -c "write $vmstate 0 128k " "$BLKDBG_TEST_IMG" | _filter_qemu_io
++$QEMU_IO -c "write $vmstate 0 128k " "$BLKDBG_TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
+
+ # l2_load is not called on allocation, so issue a second write
+ # Reads are another path to trigger l2_load, so do a read, too
+ if [ "$event" == "l2_load" ]; then
+- $QEMU_IO -c "write $vmstate 0 128k " "$BLKDBG_TEST_IMG" | _filter_qemu_io
+- $QEMU_IO -c "read $vmstate 0 128k " "$BLKDBG_TEST_IMG" | _filter_qemu_io
++ $QEMU_IO -c "write $vmstate 0 128k " "$BLKDBG_TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
++ $QEMU_IO -c "read $vmstate 0 128k " "$BLKDBG_TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
+ fi
+
+ _check_test_img_ignore_leaks 2>&1 | grep -v "refcount=1 reference=0"
+@@ -155,7 +155,7 @@ _make_test_img 1G
+
+ echo
+ echo "Event: $event; errno: $errno; imm: $imm; once: $once; write $vmstate"
+-$QEMU_IO -c "write $vmstate 0 64M" "$BLKDBG_TEST_IMG" | _filter_qemu_io
++$QEMU_IO -c "write $vmstate 0 64M" "$BLKDBG_TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
+
+ _check_test_img_ignore_leaks 2>&1 | grep -v "refcount=1 reference=0"
+
+@@ -194,7 +194,7 @@ _make_test_img 1G
+
+ echo
+ echo "Event: $event; errno: $errno; imm: $imm; once: $once"
+-$QEMU_IO -c "write -b 0 64k" "$BLKDBG_TEST_IMG" | _filter_qemu_io
++$QEMU_IO -c "write -b 0 64k" "$BLKDBG_TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
+
+ _check_test_img_ignore_leaks 2>&1 | grep -v "refcount=1 reference=0"
+
+diff --git a/tests/qemu-iotests/026.out b/tests/qemu-iotests/026.out
+index 83989996ff..a92286fab5 100644
+--- a/tests/qemu-iotests/026.out
++++ b/tests/qemu-iotests/026.out
+@@ -14,15 +14,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_update; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_update; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -38,15 +42,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_update; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_update; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -126,15 +134,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_update; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_update; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -150,15 +162,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_update; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_update; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -174,15 +190,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_alloc_write; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_alloc_write; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -198,15 +218,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_alloc_write; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l2_alloc_write; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -222,15 +246,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: write_aio; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: write_aio; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -246,15 +274,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: write_aio; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: write_aio; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -270,15 +302,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_load; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_load; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -294,15 +330,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_load; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_load; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -318,15 +358,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_update_part; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_update_part; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -342,15 +386,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_update_part; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_update_part; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -366,15 +414,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc; errno: 5; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc; errno: 5; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -390,15 +442,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -457,15 +513,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_hookup; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_hookup; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -481,15 +541,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -505,15 +569,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write_blocks; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write_blocks; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -529,15 +597,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write_table; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_write_table; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -553,15 +625,19 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_switch_table; errno: 28; imm: off; once: off; write
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: refblock_alloc_switch_table; errno: 28; imm: off; once: off; write -b
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+
+@@ -595,8 +671,10 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_grow_write_table; errno: 5; imm: off; once: off
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -607,8 +685,10 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_grow_write_table; errno: 28; imm: off; once: off
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -619,8 +699,10 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_grow_activate_table; errno: 5; imm: off; once: off
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ qemu-io: Failed to flush the L2 table cache: Input/output error
+ qemu-io: Failed to flush the refcount block cache: Input/output error
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: Input/output error
+ write failed: Input/output error
+ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+@@ -631,8 +713,10 @@ No errors were found on the image.
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+
+ Event: l1_grow_activate_table; errno: 28; imm: off; once: off
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ qemu-io: Failed to flush the L2 table cache: No space left on device
+ qemu-io: Failed to flush the refcount block cache: No space left on device
++qemu-io: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.qcow2' during close: No space left on device
+ write failed: No space left on device
+ No errors were found on the image.
+
+diff --git a/tests/qemu-iotests/071 b/tests/qemu-iotests/071
+index 331f8cfddc..3058db5bce 100755
+--- a/tests/qemu-iotests/071
++++ b/tests/qemu-iotests/071
+@@ -53,7 +53,7 @@ do_run_qemu()
+
+ run_qemu()
+ {
+- do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qemu | _filter_qmp | _filter_qemu_io
++ do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qemu | _filter_qmp | _filter_qemu_io | _filter_json_filename
+ }
+
+ IMG_SIZE=64M
+diff --git a/tests/qemu-iotests/071.out b/tests/qemu-iotests/071.out
+index a2923b05c2..4014ae2bb3 100644
+--- a/tests/qemu-iotests/071.out
++++ b/tests/qemu-iotests/071.out
+@@ -85,8 +85,10 @@ wrote 512/512 bytes at offset 0
+ read failed: Input/output error
+ {"return": ""}
+ {"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
++QEMU_PROG: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+ QEMU_PROG: Failed to flush the L2 table cache: Input/output error
+ QEMU_PROG: Failed to flush the refcount block cache: Input/output error
++QEMU_PROG: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+ {"return": {}}
+
+ *** done
+diff --git a/tests/qemu-iotests/080.out b/tests/qemu-iotests/080.out
+index d8acb3e723..4534ca1219 100644
+--- a/tests/qemu-iotests/080.out
++++ b/tests/qemu-iotests/080.out
+@@ -66,6 +66,7 @@ wrote 512/512 bytes at offset 0
+ qemu-img: Failed to load snapshot: Snapshot L1 table offset invalid
+ qemu-img: Snapshot L1 table offset invalid
+ qemu-img: Failed to turn zero into data clusters: Invalid argument
++qemu-io: Failed flush for 'TEST_DIR/t.qcow2' during close: Invalid argument
+ qemu-io: Failed to flush the refcount block cache: Invalid argument
+ write failed: Invalid argument
+ qemu-img: Snapshot L1 table offset invalid
+@@ -89,6 +90,7 @@ wrote 512/512 bytes at offset 0
+ qemu-img: Failed to load snapshot: Snapshot L1 table too large
+ qemu-img: Snapshot L1 table too large
+ qemu-img: Failed to turn zero into data clusters: File too large
++qemu-io: Failed flush for 'TEST_DIR/t.qcow2' during close: File too large
+ qemu-io: Failed to flush the refcount block cache: File too large
+ write failed: File too large
+ qemu-img: Snapshot L1 table too large
+diff --git a/tests/qemu-iotests/098.out b/tests/qemu-iotests/098.out
+index 6c73dd0977..912b0290af 100644
+--- a/tests/qemu-iotests/098.out
++++ b/tests/qemu-iotests/098.out
+@@ -6,6 +6,7 @@ Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+ wrote 65536/65536 bytes at offset 0
+ 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++qemu-img: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT' during close: Input/output error
+ qemu-img: Failed to empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+ No errors were found on the image.
+
+@@ -15,6 +16,7 @@ Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+ wrote 65536/65536 bytes at offset 0
+ 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++qemu-img: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT' during close: Input/output error
+ qemu-img: Failed to empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+ Leaked cluster 4 refcount=1 reference=0
+ Leaked cluster 5 refcount=1 reference=0
+@@ -28,6 +30,7 @@ Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+ wrote 65536/65536 bytes at offset 0
+ 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++qemu-img: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT' during close: Input/output error
+ qemu-img: Failed to empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+ ERROR cluster 0 refcount=0 reference=1
+ ERROR cluster 1 refcount=0 reference=1
+@@ -42,6 +45,7 @@ Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
+ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+ wrote 65536/65536 bytes at offset 0
+ 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++qemu-img: Failed flush for 'blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT' during close: Input/output error
+ qemu-img: Failed to empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+ ERROR cluster 0 refcount=0 reference=1
+ ERROR cluster 1 refcount=0 reference=1
+diff --git a/tests/qemu-iotests/122 b/tests/qemu-iotests/122
+index 488649f1bd..9da1246f09 100755
+--- a/tests/qemu-iotests/122
++++ b/tests/qemu-iotests/122
+@@ -357,15 +357,15 @@ target_fails_flush="json:{
+ }
+ }"
+
+-$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush"
+-echo "qemu-img convert exited with status $?"
++$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush" 2>&1 | _filter_json_filename
++echo "qemu-img convert exited with status ${PIPESTATUS[0]}"
+
+ echo
+ echo "=== failing flush after convert with 'writeback' cache mode ==="
+ echo
+
+-$QEMU_IMG convert -t writeback -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush"
+-echo "qemu-img convert exited with status $?"
++$QEMU_IMG convert -t writeback -f $IMGFMT -O $IMGFMT -n "$TEST_IMG".orig "$target_fails_flush" 2>&1 | _filter_json_filename
++echo "qemu-img convert exited with status ${PIPESTATUS[0]}"
+
+ # success, all done
+ echo '*** done'
+diff --git a/tests/qemu-iotests/122.out b/tests/qemu-iotests/122.out
+index f3e28f33bc..84283f2434 100644
+--- a/tests/qemu-iotests/122.out
++++ b/tests/qemu-iotests/122.out
+@@ -267,7 +267,9 @@ qemu-img convert exited with status 0
+
+ === failing flush after convert with 'writeback' cache mode ===
+
++qemu-img: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+ qemu-img: Failed to flush the L2 table cache: Input/output error
+ qemu-img: Failed to flush the refcount block cache: Input/output error
++qemu-img: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+ qemu-img convert exited with status 0
+ *** done
+diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
+index 2a98ad58f5..ef32f8ec03 100755
+--- a/tests/qemu-iotests/244
++++ b/tests/qemu-iotests/244
+@@ -264,7 +264,7 @@ $QEMU_IO -c 'write 0 512' -c flush \
+ }
+ }
+ }" \
+- | _filter_qemu_io
++ 2>&1 | _filter_qemu_io | _filter_generated_node_ids
+
+ result=${PIPESTATUS[0]}
+ echo
+diff --git a/tests/qemu-iotests/244.out b/tests/qemu-iotests/244.out
+index c62f5aec25..8935f544cd 100644
+--- a/tests/qemu-iotests/244.out
++++ b/tests/qemu-iotests/244.out
+@@ -134,6 +134,7 @@ Images are identical.
+
+ === Flushing should flush the data file ===
+
++qemu-io: Failed flush for 'NODE_NAME' during close: Input/output error
+ wrote 512/512 bytes at offset 0
+ 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+diff --git a/tests/qemu-iotests/tests/file-io-error b/tests/qemu-iotests/tests/file-io-error
+index 0d970c102f..3885b741d9 100755
+--- a/tests/qemu-iotests/tests/file-io-error
++++ b/tests/qemu-iotests/tests/file-io-error
+@@ -94,7 +94,7 @@ echo "$output"
+
+ echo
+ # This should fail, but gracefully, i.e. just print an I/O error, not crash.
+-$QEMU_IO -f file -c 'write 0 64M' "$TEST_DIR/fuse-export" | _filter_qemu_io
++$QEMU_IO -f file -c 'write 0 64M' "$TEST_DIR/fuse-export" 2>&1 | _filter_qemu_io | _filter_testdir
+ echo
+
+ capture_events=BLOCK_EXPORT_DELETED _send_qemu_cmd $QEMU_HANDLE \
+diff --git a/tests/qemu-iotests/tests/file-io-error.out b/tests/qemu-iotests/tests/file-io-error.out
+index 0f46455a94..b5ac8d3db1 100644
+--- a/tests/qemu-iotests/tests/file-io-error.out
++++ b/tests/qemu-iotests/tests/file-io-error.out
+@@ -21,6 +21,7 @@ QA output created by file-io-error
+ }}
+ {"return": {}}
+
++qemu-io: Failed flush for 'TEST_DIR/fuse-export' during close: Input/output error
+ write failed: Input/output error
+
+ {'execute': 'block-export-del',
+@@ -29,5 +30,6 @@ write failed: Input/output error
+ {"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "exp0"}}
+ {'execute': 'blockdev-del',
+ 'arguments': {'node-name': 'node0'}}
++QEMU_PROG: Failed flush for 'node0' during close: Input/output error
+ {"return": {}}
+ *** done
+diff --git a/tests/qemu-iotests/tests/qsd-migrate b/tests/qemu-iotests/tests/qsd-migrate
+index a4c6592420..3fb5b2e475 100755
+--- a/tests/qemu-iotests/tests/qsd-migrate
++++ b/tests/qemu-iotests/tests/qsd-migrate
+@@ -20,7 +20,7 @@
+
+ import iotests
+
+-from iotests import filter_qemu_io, filter_qtest
++from iotests import filter_qemu, filter_qemu_io, filter_qtest
+
+ iotests.script_initialize(supported_fmts=['qcow2', 'qed', 'raw'],
+ supported_protocols=['file'],
+@@ -125,11 +125,12 @@ with iotests.FilePath('disk.img') as path, \
+
+ iotests.log('\nDone')
+
++ # NOTE: Flush during close fails here, since the QSD node was inactivated.
+ vm_src.shutdown()
+ iotests.log('\n--- vm_src log ---')
+ log = vm_src.get_log()
+ if log:
+- iotests.log(log, [filter_qtest, filter_qemu_io])
++ iotests.log(log, [filter_qtest, filter_qemu_io, filter_qemu])
+ qsd_src.stop()
+
+ vm_dst.shutdown()
+diff --git a/tests/qemu-iotests/tests/qsd-migrate.out b/tests/qemu-iotests/tests/qsd-migrate.out
+index 4a5241e5d4..894b232b4a 100644
+--- a/tests/qemu-iotests/tests/qsd-migrate.out
++++ b/tests/qemu-iotests/tests/qsd-migrate.out
+@@ -47,6 +47,7 @@ read 4096/4096 bytes at offset 0
+ 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ read 4096/4096 bytes at offset 0
+ 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++QEMU_PROG: Failed flush for 'disk' during close: Operation not permitted
+
+ --- vm_dst log ---
+ read 4096/4096 bytes at offset 0
diff --git a/debian/patches/extra/0012-qemu-img-convert-flush-target-image-after-copying.patch b/debian/patches/extra/0012-qemu-img-convert-flush-target-image-after-copying.patch
new file mode 100644
index 0000000000..b7962dfd96
--- /dev/null
+++ b/debian/patches/extra/0012-qemu-img-convert-flush-target-image-after-copying.patch
@@ -0,0 +1,99 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Thu, 8 Oct 2026 08:11:45 -0500
+Subject: [PATCH] qemu-img: convert: flush target image after copying
+
+With 'qemu-img convert', when using a cache mode with 'cache.no-flush
+= off', the expectation is that the data is flushed to the disk, which
+happens since commit 80ccf93b88 ("qemu-img: let 'qemu-img convert'
+flush data"). This expectation also encompasses that failure to do so
+is properly reported, so ensure that 'qemu-img convert' exits with a
+non-zero status code when the target image cannot be flushed.
+
+In particular, the reproducer below [0], based on a report by
+Ing. Alfonso Kuen Arroyo [1], would result in
+> rc=0
+> Content mismatch at offset XYZ!
+before this change, and in
+> rc=1
+> Content mismatch at offset XYZ!
+after this change.
+
+Note that this change does not affect the (default) 'unsafe' cache
+mode, because bdrv_co_flush() still skips flush to disk for that cache
+mode.
+
+[0]:
+> #!/bin/bash -x
+> dd if=/dev/urandom of=src.raw bs=1M count=500
+> truncate -s 500M dst.img
+> LOOP=$(losetup --find --show dst.img)
+> SIZE=$(blockdev --getsz $LOOP)
+> dd if=/dev/zero of=$LOOP bs=1M count=500 conv=fsync status=none
+> sync
+> echo 3 > /proc/sys/vm/drop_caches
+> dmsetup create flk --table "0 $SIZE flakey $LOOP 0 5 5"
+> qemu-img convert -t writeback -p -r 100M -f raw -O raw src.raw /dev/mapper/flk
+> echo rc=$?
+> sleep 5
+> dmsetup remove flk
+> qemu-img compare src.raw $LOOP
+> losetup -d $LOOP
+> rm src.raw dst.img
+
+[1]: https://lore.proxmox.com/pve-devel/178961792132.43804.17173233935297903311@idkmanager.com/
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Message-ID: <20260930132140.2342574-5-f.ebner@proxmox.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20261008131216.2437896-23-eblake@redhat.com
+(pick from qemu-devel)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ qemu-img.c | 8 +++++++-
+ tests/qemu-iotests/122.out | 3 ++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/qemu-img.c b/qemu-img.c
+index 2f63d31141..edf75e43ab 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -2245,7 +2245,7 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
+ Error *local_err = NULL;
+ bool writethrough, src_writethrough, image_opts = false,
+ skip_create = false, progress = false, tgt_image_opts = false;
+- int64_t ret = -EINVAL;
++ int64_t ret = -EINVAL, ret2;
+ bool force_share = false;
+ bool explict_min_sparse = false;
+ bool bitmaps = false;
+@@ -2872,6 +2872,12 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
+ ret = convert_copy_bitmaps(blk_bs(s.src[0]), out_bs, skip_broken);
+ }
+
++ ret2 = blk_flush(s.target);
++ if (ret2 < 0) {
++ error_report("Failed to flush target image: %s", strerror(-ret2));
++ ret = ret != 0 ? ret : ret2;
++ }
++
+ out:
+ if (!ret) {
+ qemu_progress_print(100, 0);
+diff --git a/tests/qemu-iotests/122.out b/tests/qemu-iotests/122.out
+index 84283f2434..38794f96ac 100644
+--- a/tests/qemu-iotests/122.out
++++ b/tests/qemu-iotests/122.out
+@@ -267,9 +267,10 @@ qemu-img convert exited with status 0
+
+ === failing flush after convert with 'writeback' cache mode ===
+
++qemu-img: Failed to flush target image: Input/output error
+ qemu-img: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+ qemu-img: Failed to flush the L2 table cache: Input/output error
+ qemu-img: Failed to flush the refcount block cache: Input/output error
+ qemu-img: Failed flush for 'json:{ /* filtered */ }' during close: Input/output error
+-qemu-img convert exited with status 0
++qemu-img convert exited with status 1
+ *** done
diff --git a/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
index e872eb361d..0c61285b6f 100644
--- a/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/qemu-img.c b/qemu-img.c
-index 2f63d31141..2f9e8e77b8 100644
+index edf75e43ab..43f86aa773 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -3185,7 +3185,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -3191,7 +3191,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
list = collect_image_info_list(image_opts, filename, fmt, cache, chain,
limits, force_share);
if (!list) {
diff --git a/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
index 9184458394..355c333078 100644
--- a/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -55,10 +55,10 @@ index 6bc8265cfb..85458ea2d8 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index 2f9e8e77b8..dad04c865e 100644
+index 43f86aa773..82856a38a8 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5320,10 +5320,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5326,10 +5326,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_IF 04
#define C_OF 010
#define C_SKIP 020
@@ -71,7 +71,7 @@ index 2f9e8e77b8..dad04c865e 100644
};
struct DdIo {
-@@ -5399,6 +5401,19 @@ static int img_dd_skip(const char *arg,
+@@ -5405,6 +5407,19 @@ static int img_dd_skip(const char *arg,
return 0;
}
@@ -91,7 +91,7 @@ index 2f9e8e77b8..dad04c865e 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5439,6 +5454,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5445,6 +5460,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "if", img_dd_if, C_IF },
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
@@ -99,7 +99,7 @@ index 2f9e8e77b8..dad04c865e 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5536,91 +5552,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5542,91 +5558,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
arg = NULL;
}
@@ -276,7 +276,7 @@ index 2f9e8e77b8..dad04c865e 100644
}
if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5637,20 +5674,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5643,20 +5680,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
for (out_pos = 0; in_pos < size; ) {
diff --git a/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
index db3a1bfaa8..72dbb64ab3 100644
--- a/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -17,10 +17,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/qemu-img.c b/qemu-img.c
-index dad04c865e..f64a8cb3d3 100644
+index 82856a38a8..eaa143fe48 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5321,11 +5321,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5327,11 +5327,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_OF 010
#define C_SKIP 020
#define C_OSIZE 040
@@ -34,7 +34,7 @@ index dad04c865e..f64a8cb3d3 100644
};
struct DdIo {
-@@ -5414,6 +5416,19 @@ static int img_dd_osize(const char *arg,
+@@ -5420,6 +5422,19 @@ static int img_dd_osize(const char *arg,
return 0;
}
@@ -54,7 +54,7 @@ index dad04c865e..f64a8cb3d3 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5428,12 +5443,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5434,12 +5449,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int c, i;
const char *out_fmt = "raw";
const char *fmt = NULL;
@@ -70,7 +70,7 @@ index dad04c865e..f64a8cb3d3 100644
};
struct DdIo in = {
.bsz = 512, /* Block size is by default 512 bytes */
-@@ -5455,6 +5472,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5461,6 +5478,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
{ "osize", img_dd_osize, C_OSIZE },
@@ -78,7 +78,7 @@ index dad04c865e..f64a8cb3d3 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5673,9 +5691,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5679,9 +5697,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
@@ -91,7 +91,7 @@ index dad04c865e..f64a8cb3d3 100644
if (blk1) {
in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
if (in_ret == 0) {
-@@ -5684,6 +5703,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5690,6 +5709,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
} else {
in_ret = read(STDIN_FILENO, in.buf, bytes);
if (in_ret == 0) {
diff --git a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
index 5684d3c819..d42e207565 100644
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -66,10 +66,10 @@ index 85458ea2d8..f97c2fa396 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index f64a8cb3d3..e8e2b0eb68 100644
+index eaa143fe48..25cf0babe4 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5445,7 +5445,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5451,7 +5451,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
const char *fmt = NULL;
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
@@ -78,7 +78,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5485,7 +5485,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5491,7 +5491,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -87,7 +87,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
if (c == EOF) {
break;
}
-@@ -5526,6 +5526,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5532,6 +5532,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'O':
out_fmt = optarg;
break;
@@ -97,7 +97,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
case 'U':
force_share = true;
break;
-@@ -5655,13 +5658,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5661,13 +5664,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
size - in.bsz * in.offset, &error_abort);
}
diff --git a/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
index f3bd76dd6a..00a77964b6 100644
--- a/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -48,10 +48,10 @@ index f97c2fa396..206ca7381c 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index e8e2b0eb68..8da92a63c0 100644
+index 25cf0babe4..21ec5615e2 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5437,6 +5437,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5443,6 +5443,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
BlockDriver *drv = NULL, *proto_drv = NULL;
BlockBackend *blk1 = NULL, *blk2 = NULL;
QemuOpts *opts = NULL;
@@ -59,7 +59,7 @@ index e8e2b0eb68..8da92a63c0 100644
QemuOptsList *create_opts = NULL;
Error *local_err = NULL;
bool image_opts = false;
-@@ -5446,6 +5447,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5452,6 +5453,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
bool force_share = false, skip_create = false;
@@ -67,7 +67,7 @@ index e8e2b0eb68..8da92a63c0 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5485,7 +5487,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5491,7 +5493,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -76,7 +76,7 @@ index e8e2b0eb68..8da92a63c0 100644
if (c == EOF) {
break;
}
-@@ -5529,6 +5531,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5535,6 +5537,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'n':
skip_create = true;
break;
@@ -96,7 +96,7 @@ index e8e2b0eb68..8da92a63c0 100644
case 'U':
force_share = true;
break;
-@@ -5587,11 +5602,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5593,11 +5608,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
if (dd.flags & C_IF) {
blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
force_share);
@@ -122,7 +122,7 @@ index e8e2b0eb68..8da92a63c0 100644
}
if (dd.flags & C_OSIZE) {
-@@ -5746,6 +5774,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5752,6 +5780,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
out:
g_free(arg);
qemu_opts_del(opts);
diff --git a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
index e23026c00b..ba7324d481 100644
--- a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
@@ -259,7 +259,7 @@ index 83f858669f..d7ab3cb78f 100644
'blklogwrites.c',
'blkverify.c',
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 147c08155f..41c82fc1ab 100644
+index 46428b034d..94b1dd347d 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -25,6 +25,7 @@
diff --git a/debian/patches/series b/debian/patches/series
index 3140ed6230..327621af89 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,6 +2,14 @@ extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
+extra/0005-hw-usb-hcd-xhci-Limit-DMA-transfers-to-plain-memory.patch
+extra/0006-block-Fix-corruption-from-broken-RMW-atomicity.patch
+extra/0007-block-Remove-now-redundant-bdrv_wait_serialising_req.patch
+extra/0008-block-fix-bdrv_next-skipping-monitor-owned-nodes.patch
+extra/0009-iotests-add-test-cases-for-failing-flush-after-qemu-.patch
+extra/0010-iotests.py-add-filter_qemu.patch
+extra/0011-block-report-flush-error-during-bdrv_close.patch
+extra/0012-qemu-img-convert-flush-target-image-after-copying.patch
bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
--
2.47.3
prev parent reply other threads:[~2026-10-12 11:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 10:51 [PATCH-SERIES qemu 0/2] stable fixes for QEMU 11.1 Fiona Ebner
2026-10-12 10:51 ` [PATCH qemu 1/2] update submodule and patches to QEMU 11.1.2 Fiona Ebner
2026-10-12 10:51 ` Fiona Ebner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261012105232.146528-3-f.ebner@proxmox.com \
--to=f.ebner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox