Ensure image conversion flushes output data to disk

qemu-img convert defaults to cache=none, which means that when it
completes the output data may still only be in the host kernel's
cache rather than on persistent storage. A host crash at this point
will leave a file with the correct metadata (name, size, ownership,
permissions), but no contents. This will prevent qcow2 instances on
that compute host which use that image from restarting, and requires
manual intervention from an operator to fix.

See also change Id9905a87, which fixes this issue for downloads
without a conversion.

Closes-Bug: #1669844
Change-Id: I33bd99b0752111ff7057f9bd40e58dcde77c7d95

1 files changed, 8 insertions, 1 deletions

diff --git a/nova/virt/images.py b/nova/virt/images.py
index fc4db6275e..b7f46a73ab 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -101,7 +101,14 @@ def convert_image_unsafe(source, dest, out_format, run_as_root=False):
 
 
 def _convert_image(source, dest, in_format, out_format, run_as_root):
-    cmd = ('qemu-img', 'convert', '-O', out_format)
+    # NOTE(mdbooth): qemu-img convert defaults to cache=unsafe, which means
+    # that data is not synced to disk at completion. We explicitly use
+    # cache=none here to (1) ensure that we don't interfere with other
+    # applications using the host's io cache, and (2) ensure that the data is
+    # on persistent storage when the command exits. Without (2), a host crash
+    # may leave a corrupt image in the image cache, which Nova cannot recover
+    # automatically.
+    cmd = ('qemu-img', 'convert', '-t', 'none', '-O', out_format)
     if in_format is not None:
         cmd = cmd + ('-f', in_format)
     cmd = cmd + (source, dest)