[jira] [Updated] (HDDS-16692) OMSnapshotMoveDeletedKeysResponse writes two snapshot DBs without SNAPSHOT_DB_CONTENT_LOCK

["Siyao Meng (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HDDS-16692?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Siyao Meng updated HDDS-16692:
------------------------------
    Attachment: HDDS-16692-CR-R14-missing-content-lock.patch

> OMSnapshotMoveDeletedKeysResponse writes two snapshot DBs without SNAPSHOT_DB_CONTENT_LOCK
> ------------------------------------------------------------------------------------------
>
>                 Key: HDDS-16692
>                 URL: https://issues.apache.org/jira/browse/HDDS-16692
>             Project: Apache Ozone
>          Issue Type: Bug
>            Reporter: Siyao Meng
>            Priority: Major
>         Attachments: HDDS-16692-CR-R14-missing-content-lock.patch
>
>
> h3. Mechanism
> {{OMSnapshotMoveDeletedKeysResponse.addToDBBatch}} ({{:89-130}}) writes both the from and to snapshots' tables without acquiring {{SNAPSHOT_DB_CONTENT_LOCK}}, while its sibling {{OMSnapshotMoveTableKeysResponse}} acquires it at {{:93}} and releases it at {{:131}}. {{DAGLeveledResource}}'s own javadoc states the content lock should always be acquired before opening a snapshot.
> h3. Impact
> The exclusion the content lock exists to provide is absent for those writes, so during upgrade replay of an older Raft log entry a concurrent defrag or purge is not excluded from writes to those snapshot DBs.
> h3. Verification status
> Environment limited. This finding rests on the verified source asymmetry against its sibling response plus the existing replay path. No concrete corruption was demonstrated: the verification host had no Ozone cluster, no pre upgrade Raft log and no network egress, so the trigger could not be produced. Rated Major rather than Critical for that reason. The source level asymmetry is worth fixing on its own.
> h3. Reproduction
> {{repro/test_bugCR-R14_legacy_move_no_content_lock.sh}} records the source comparison. No runtime reproduction is available.
> h3. Patch
> {{HDDS-XXXXX-CR-R14-missing-content-lock.patch}} is attached. It applies to 20e6a1c0f6039248373efd3eb1d7f2afcf7f1535 and mirrors OMSnapshotMoveTableKeysResponse.addToDBBatch: acquireReadLocks on SNAPSHOT_DB_CONTENT_LOCK for the involved snapshot IDs, released in a finally. Verified to compile.
> The patch carries no regression test. The natural home is a new test modelled on TestOMSnapshotMoveTableKeysResponse, which extends SnapshotRequestAndResponseTests, and that base class mocks a final class and so needs Mockito's inline mock maker. The verification host denies the JVM self attach the inline maker requires, so the whole fixture errors before any assertion runs. Rather than attach a test that was never executed, it is left for review to add in an environment where that fixture runs.
> Found by code review of the OM snapshot cache under HDDS-15926, on commit 20e6a1c0f6039248373efd3eb1d7f2afcf7f1535. Generated with Specula (Claude Opus 5).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org