On Tue, Feb 19, 2019 at 8:03 PM Thomas Munro <thomas.mu...@gmail.com> wrote: > A theoretical question I thought of is whether there are any > interleavings of operations that allow a checkpoint to complete > bogusly, while a concurrent close() in a regular backend fails with > EIO for data that was included in the checkpoint, and panics. I > *suspect* the answer is that every interleaving is safe for 4.16+ > kernels that report IO errors to every descriptor. In older kernels I > wonder if there could be a schedule where an arbitrary backend eats > the error while closing, then the checkpointer calls fsync() > successfully and then logs a checkpoint, and then then the arbitrary > backend panics (too late). I suspect EIO on close() doesn't happen in > practice on regular local filesystems, which is why I mention it in > the context of NFS, but I could be wrong about that.
Ugh. It looks like Linux NFS doesn't even use the new errseq_t machinery in 4.16+. So even if we had the fd-passing patch, I think there may be a dangerous schedule like this: A: close() -> EIO, clears AS_EIO flag B: fsync() -> SUCCESS, log a checkpoint A: panic! (but it's too late, we already logged a checkpoint but didn't flush all the dirty data the belonged to it) -- Thomas Munro https://enterprisedb.com
