[
https://issues.apache.org/jira/browse/HDDS-16692?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-16692:
------------------------------
Attachment: HDDS-16692-CR-R14-missing-content-lock.patch
> OMSnapshotMoveDeletedKeysResponse writes two snapshot DBs without
> SNAPSHOT_DB_CONTENT_LOCK
> ------------------------------------------------------------------------------------------
>
> Key: HDDS-16692
> URL: https://issues.apache.org/jira/browse/HDDS-16692
> Project: Apache Ozone
> Issue Type: Bug
> Reporter: Siyao Meng
> Priority: Major
> Attachments: HDDS-16692-CR-R14-missing-content-lock.patch
>
>
> h3. Mechanism
> {{OMSnapshotMoveDeletedKeysResponse.addToDBBatch}} ({{:89-130}}) writes both
> the from and to snapshots' tables without acquiring
> {{SNAPSHOT_DB_CONTENT_LOCK}}, while its sibling
> {{OMSnapshotMoveTableKeysResponse}} acquires it at {{:93}} and releases it at
> {{:131}}. {{DAGLeveledResource}}'s own javadoc states the content lock should
> always be acquired before opening a snapshot.
> h3. Impact
> The exclusion the content lock exists to provide is absent for those writes,
> so during upgrade replay of an older Raft log entry a concurrent defrag or
> purge is not excluded from writes to those snapshot DBs.
> h3. Verification status
> Environment limited. This finding rests on the verified source asymmetry
> against its sibling response plus the existing replay path. No concrete
> corruption was demonstrated: the verification host had no Ozone cluster, no
> pre upgrade Raft log and no network egress, so the trigger could not be
> produced. Rated Major rather than Critical for that reason. The source level
> asymmetry is worth fixing on its own.
> h3. Reproduction
> {{repro/test_bugCR-R14_legacy_move_no_content_lock.sh}} records the source
> comparison. No runtime reproduction is available.
> h3. Patch
> {{HDDS-XXXXX-CR-R14-missing-content-lock.patch}} is attached. It applies to
> 20e6a1c0f6039248373efd3eb1d7f2afcf7f1535 and mirrors
> OMSnapshotMoveTableKeysResponse.addToDBBatch: acquireReadLocks on
> SNAPSHOT_DB_CONTENT_LOCK for the involved snapshot IDs, released in a
> finally. Verified to compile.
> The patch carries no regression test. The natural home is a new test modelled
> on TestOMSnapshotMoveTableKeysResponse, which extends
> SnapshotRequestAndResponseTests, and that base class mocks a final class and
> so needs Mockito's inline mock maker. The verification host denies the JVM
> self attach the inline maker requires, so the whole fixture errors before any
> assertion runs. Rather than attach a test that was never executed, it is left
> for review to add in an environment where that fixture runs.
> Found by code review of the OM snapshot cache under HDDS-15926, on commit
> 20e6a1c0f6039248373efd3eb1d7f2afcf7f1535. Generated with Specula (Claude Opus
> 5).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
