Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity

ZIL: Do not clone blocks from the future 

ZIL claim can not handle block pointers cloned from the future,
since they are not yet allocated at that point.  It may happen
either if the block was just written when it was cloned, or if
the pool was frozen or somehow else rewound on import.

Handle it from two sides: prevent cloning of blocks with physical
birth time from not yet synced or frozen TXG, and abort ZIL claim
if we still detect such blocks due to rewind or something else.

While there, assert that any cloned blocks we claim are really
allocated by calling metaslab_check_free().

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Alexander Motin <mav@FreeBSD.org>
Sponsored by:	iXsystems, Inc.
Closes #15617
This commit is contained in:
Alexander Motin 2023-12-05 13:58:11 -05:00 committed by GitHub
parent 014265f4e6
commit 55b764e062
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 43 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
module/zfs/dmu.c
View File

@ -2274,6 +2274,21 @@ dmu_read_l0_bps(objset_t *os, uint64_t object, uint64_t offset, uint64_t length,
goto out; goto out;
} }
/*
* If the block was allocated in transaction group that is not
* yet synced, we could clone it, but we couldn't write this
* operation into ZIL, or it may be impossible to replay, since
* the block may appear not yet allocated at that point.
*/
if (BP_PHYSICAL_BIRTH(bp) > spa_freeze_txg(os->os_spa)) {
error = SET_ERROR(EINVAL);
goto out;
}
if (BP_PHYSICAL_BIRTH(bp) > spa_last_synced_txg(os->os_spa)) {
error = SET_ERROR(EAGAIN);
goto out;
}
bps[i] = *bp; bps[i] = *bp;
} }

38
module/zfs/zil.c
View File

@ -617,11 +617,12 @@ zil_claim_write(zilog_t *zilog, const lr_t *lrc, void *tx, uint64_t first_txg)
} }
static int static int
zil_claim_clone_range(zilog_t *zilog, const lr_t *lrc, void *tx) zil_claim_clone_range(zilog_t *zilog, const lr_t *lrc, void *tx,
uint64_t first_txg)
{ {
const lr_clone_range_t *lr = (const lr_clone_range_t *)lrc; const lr_clone_range_t *lr = (const lr_clone_range_t *)lrc;
const blkptr_t *bp; const blkptr_t *bp;
spa_t *spa; spa_t *spa = zilog->zl_spa;
uint_t ii; uint_t ii;
ASSERT3U(lrc->lrc_reclen, >=, sizeof (*lr)); ASSERT3U(lrc->lrc_reclen, >=, sizeof (*lr));
@ -636,19 +637,36 @@ zil_claim_clone_range(zilog_t *zilog, const lr_t *lrc, void *tx)
* XXX: Do we need to byteswap lr? * XXX: Do we need to byteswap lr?
*/ */
spa = zilog->zl_spa;
for (ii = 0; ii < lr->lr_nbps; ii++) { for (ii = 0; ii < lr->lr_nbps; ii++) {
bp = &lr->lr_bps[ii]; bp = &lr->lr_bps[ii];
/* /*
* When data in embedded into BP there is no need to create * When data is embedded into the BP there is no need to create
* BRT entry as there is no data block. Just copy the BP as * BRT entry as there is no data block. Just copy the BP as it
* it contains the data. * contains the data.
*/ */
if (!BP_IS_HOLE(bp) && !BP_IS_EMBEDDED(bp)) { if (BP_IS_HOLE(bp) || BP_IS_EMBEDDED(bp))
continue;
/*
* We can not handle block pointers from the future, since they
* are not yet allocated. It should not normally happen, but
* just in case lets be safe and just stop here now instead of
* corrupting the pool.
*/
if (BP_PHYSICAL_BIRTH(bp) >= first_txg)
return (SET_ERROR(ENOENT));
/*
* Assert the block is really allocated before we reference it.
*/
metaslab_check_free(spa, bp);
}
for (ii = 0; ii < lr->lr_nbps; ii++) {
bp = &lr->lr_bps[ii];
if (!BP_IS_HOLE(bp) && !BP_IS_EMBEDDED(bp))
brt_pending_add(spa, bp, tx); brt_pending_add(spa, bp, tx);
}
} }
return (0); return (0);
@ -663,7 +681,7 @@ zil_claim_log_record(zilog_t *zilog, const lr_t *lrc, void *tx,
case TX_WRITE: case TX_WRITE:
return (zil_claim_write(zilog, lrc, tx, first_txg)); return (zil_claim_write(zilog, lrc, tx, first_txg));
case TX_CLONE_RANGE: case TX_CLONE_RANGE:
return (zil_claim_clone_range(zilog, lrc, tx)); return (zil_claim_clone_range(zilog, lrc, tx, first_txg));
default: default:
return (0); return (0);
} }