Siyao Meng created HDDS-16692:
---------------------------------
Summary: OMSnapshotMoveDeletedKeysResponse writes two snapshot DBs
without SNAPSHOT_DB_CONTENT_LOCK
Key: HDDS-16692
URL: https://issues.apache.org/jira/browse/HDDS-16692
Project: Apache Ozone
Issue Type: Bug
Reporter: Siyao Meng
h3. Mechanism
{{OMSnapshotMoveDeletedKeysResponse.addToDBBatch}} ({{:89-130}}) writes both
the from and to snapshots' tables without acquiring
{{SNAPSHOT_DB_CONTENT_LOCK}}, while its sibling
{{OMSnapshotMoveTableKeysResponse}} acquires it at {{:93}} and releases it at
{{:131}}. {{DAGLeveledResource}}'s own javadoc states the content lock should
always be acquired before opening a snapshot.
h3. Impact
The exclusion the content lock exists to provide is absent for those writes, so
during upgrade replay of an older Raft log entry a concurrent defrag or purge
is not excluded from writes to those snapshot DBs.
h3. Verification status
Environment limited. This finding rests on the verified source asymmetry
against its sibling response plus the existing replay path. No concrete
corruption was demonstrated: the verification host had no Ozone cluster, no pre
upgrade Raft log and no network egress, so the trigger could not be produced.
Rated Major rather than Critical for that reason. The source level asymmetry is
worth fixing on its own.
h3. Reproduction
{{repro/test_bugCR-R14_legacy_move_no_content_lock.sh}} records the source
comparison. No runtime reproduction is available.
h3. Patch
{{HDDS-XXXXX-CR-R14-missing-content-lock.patch}} is attached. It applies to
20e6a1c0f6039248373efd3eb1d7f2afcf7f1535 and mirrors
OMSnapshotMoveTableKeysResponse.addToDBBatch: acquireReadLocks on
SNAPSHOT_DB_CONTENT_LOCK for the involved snapshot IDs, released in a finally.
Verified to compile.
The patch carries no regression test. The natural home is a new test modelled
on TestOMSnapshotMoveTableKeysResponse, which extends
SnapshotRequestAndResponseTests, and that base class mocks a final class and so
needs Mockito's inline mock maker. The verification host denies the JVM self
attach the inline maker requires, so the whole fixture errors before any
assertion runs. Rather than attach a test that was never executed, it is left
for review to add in an environment where that fixture runs.
Found by code review of the OM snapshot cache under HDDS-15926, on commit
20e6a1c0f6039248373efd3eb1d7f2afcf7f1535. Generated with Specula (Claude Opus
5).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
