Siyao Meng created HDDS-16465:
---------------------------------
Summary: Non atomic snapshot chain update could misdirect the
adjacency reclaim filter
Key: HDDS-16465
URL: https://issues.apache.org/jira/browse/HDDS-16465
Project: Apache Ozone
Issue Type: Bug
Reporter: Siyao Meng
h3. Finding
If the named masks were absent, the non-atomic dual-chain update / restart
rebuild could give a surviving snapshot a different effective previous and
misdirect the adjacency reclaim filter, physically reclaiming a still
chain-visible key: externally observable data loss on snapshot reads with no
automatic recovery. Reachable in principle from concurrent purge plus restart
during snapshot GC. Currently masked by atomic single-batch purge persistence,
the fail-closed corruption gate on restart rebuild, and reclaim-time
re-validation (validatePreviousSnapshotId /
validateExistingLastNSnapshotsInChain under SNAPSHOT_GC_LOCK plus the flush
gate).
h3. Classification
* Verdict: MASKED
* Severity: Critical
* Source: Specula TLA+ model checking and confirmation debate, finding CR-4
h3. Reproduce
{noformat}
Ozone commit: 9fbf9ee0cb1bd2f5f5d437b6719ebbe5309351fb
Specula: v1.1.0 (commit c6aa3dfa)
Target: om-snapshot-gc
Guidance:
campaigns/ozone-9fbf9ee/targets/008-om-snapshot-gc/.prompt-extra.md
{noformat}
{code:none}
specula run --agent=claude-code --effort=high --keep-original --max-parallel=2 \
--enable-reviews --confirm-debate --tlc-memory-limit=28G --tlc-worker-limit=8
\
"om-snapshot-gc|apache/ozone|Java|Use the target-specific .prompt-extra.md"
{code}
Discovered under HDDS-15927 (Specula TLA+ verification effort). The TLA+
specification, counterexample, and confirmation debate live in the Specula run
artifacts.
Generated with Specula (Claude Opus 4.8).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
