Skip to content

Merge release/2.6 into google/2.6#16978

Merged
jolivier23 merged 13 commits intogoogle/2.6from
jeffolivier/google/2.6
Oct 15, 2025
Merged

Merge release/2.6 into google/2.6#16978
jolivier23 merged 13 commits intogoogle/2.6from
jeffolivier/google/2.6

Conversation

@jolivier23
Copy link
Contributor

phender and others added 13 commits September 19, 2025 14:09
Avoid utilizing excessive CI resources usage while manually starting CI
jobs by disabling functional test stages that are normally skipped when
running PRs.

Signed-off-by: Phil Henderson <phillip.henderson@hpe.com>
)

Since we support EC for RF3 now, we should utilize the object class in
the auto selection for files / objects.

Signed-off-by: Mohamad Chaarawi <mohamad.chaarawi@hpe.com>
* DAOS-17948 object: fix bugs for sgl duplicate logic

1. When IO retries occur, a use-after-free scenario may arise during
scatter-gather list (sgl) merging. This happens because retried I/O's
sgl references dup_sgls, which could be prematurely freed in obj_reasb_io_fini().

To fix above issue, processed_sgls must not be freed during retry operations
and should be called only once per I/O operation.

2. If both short reads and duplicated SGLs occur, the iov_len of the original
SGLs must be updated properly to ensure the correct number of read data bytes
is returned.

3. Since only fetched data bytes are copied back, it is unnecessary to copy
the original buffer to the merged buffer before fetching.

4. A test case has been added to verify that short reads function as expected
during SGL merging.

Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
…#16851)

Mainly include the following:

1. The old implementation sets dc_obj_verify_args::current_shard
   as the shard in the first EC redundancy group. It causes that
   we always verify the first EC redundancy group without others.
   That is wrong. We need to combine it with the group index.

2. New DIOF_EC_NO_DEGRADE flag for dc_obj_fetch task to guarantee
   reading data from the specified data shard. Otherwise, related
   read request maybe automatically converted as degraded reading
   from parity shard.

3. Replace DAOS_OBJ_FORCE_DEGRADE fail_loc as OBJ fetch API flag
   DIOF_FOR_FORCE_DEGRADE for EC verification logic. Then if the
   degraded fetch RPC is retried for some reason, the retry task
   will also be degraded fetch. That will avoid self-comparing.

4. Cleanup d_sg_list_t::sg_nr_out parameter for OBJ fetch task in
   object consistency verification logic.

5. For rebuild related test cases, if need to verify parity shard,
   then set fail_loc as DAOS_OBJ_FORCE_DEGRADE | DAOS_FAIL_ALWAYS,
   That will handle RPC retry cases properly.

Signed-off-by: Fan Yong <fan.yong@hpe.com>
* DAOS-17843 placement: correct the way JCH placement calls CRC

The Jump Consistent Hash (JCH) placement algorithm in DAOS calls the CRC
functions incorrectly, which may lead to excessive hash collisions and
imbalanced data distribution.
This patch corrects how the JCH placement algorithm invokes the CRC functions.

Signed-off-by: Zhen Liang <zhen.liang@hpe.com>
Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
Slightly bump restart_duration from 120 to 140 seconds.

Signed-off-by: Niu Yawei <yawei.niu@hpe.com>
… (#16920)

Updates `github/codeql-action` from 3.30.3 to 3.30.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@192325c...3599b3b)

Signed-off-by: dependabot[bot] <support@github.com>
)

Add 2 new options for dfuse to --dump-handles and --read-handles to a
file. dump will serialize the pool, container, and dfs handles to that
file, and read will read that file for those handles and use the g2l to
connect to the pool, container and DFS.

If using MPI to launch dfuse, we should not force running in the
foreground as that introduces several limitations. MPI like clush should
be able to launch and daemonize dfuse.

Signed-off-by: Mohamad Chaarawi <mohamad.chaarawi@hpe.com>
Hadoop 3.4.2 eliminates the following vulnerabilities:

CVE-2023-39410,HIGH,7.5,"apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK","org.apache.avro:avro","1.7.7","1.11.3", https://avd.aquasec.com/nvd/cve-2023-39410

CVE-2024-47561,CRITICAL,,"apache-avro: Schema parsing may trigger Remote Code Execution (RCE)", "org.apache.avro:avro","1.9.2","1.11.4",https://avd.aquasec.com/nvd/cve-2024-47561

CVE-2025-24970,HIGH,,"io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine","io.netty:netty-handler", "4.1.100.Final","4.1.118.Final",https://avd.aquasec.com/nvd/cve-2025-24970

CVE-2025-49128,MEDIUM,,"com.fasterxml.jackson.core/jackson-core: Jackson-core Memory Disclosure via Source Snippet in JsonLocation","com.fasterxml.jackson.core:jackson-core", "2.10.2","2.13.0",https://avd.aquasec.com/nvd/cve-2025-49128

CVE-2025-48734,HIGH,,"commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "commons-beanutils:commons-beanutils","1.9.4","1.11.0", https://avd.aquasec.com/nvd/cve-2025-48734

CVE-2025-25193,MEDIUM,,"Netty, an asynchronous, event-driven network application framework, ha ...","io.netty:netty-common","4.1.115.Final","",https://avd.aquasec.com/nvd/cve-2025-25193

This PR also updates io.netty.netty-buffer from 4.1.115 to 4.1.125 to eliminate the following vulnerability:

CVE-2025-58057,MEDIUM,7.5,"netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack","io.netty:netty-codec","4.1.100.Final", "4.1.125.Final",https://avd.aquasec.com/nvd/cve-2025-58057

NOTICE:

Hadoop 3.4.2 introduces new vulnerability:

CVE-2025-58057,MEDIUM,7.5,"netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack","io.netty:netty-codec","4.1.100.Final", "4.1.125.Final",https://avd.aquasec.com/nvd/cve-2025-58057

Backport of  #16887

Signed-off-by: Tomasz Gromadzki <tomasz.gromadzki@hpe.com>
…16928)

* DAOS-17772 rebuild: refine EC agg epoch boundary process

1. add container RDB KV ds_cont_prop_ec_agg_eph for EC aggregation epoch
   boundary, store it when bump and load it after restart.
2. synchronize the ec agg boundary before rebuild
3. wait discard's completion in ds_pool_tgt_discard_handler()
4. fix a crt IV bug that ignored IV sync's GRP_VER err case

Signed-off-by: Xuezhao Liu <xuezhao.liu@hpe.com>
Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
Updates `ossf/scorecard-action` from 2.4.2 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@05b42c6...4eaacf0)

Updates `github/codeql-action` from 3.30.5 to 3.30.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@3599b3b...64d10c1)


Signed-off-by: dependabot[bot] <support@github.com>
Add opensuse-oss-proxy-artifactory for lua-lmod package dependencies.

Signed-off-by: Phil Henderson <phillip.henderson@hpe.com>
…le/2.6

Change-Id: I397b7a4907e2a71582c544105057b0561161131c
Signed-off-by: Jeff Olivier <jeffolivier@google.com>
@daosbuild3
Copy link
Collaborator

@jolivier23 jolivier23 merged commit 10a1c9d into google/2.6 Oct 15, 2025
43 of 50 checks passed
@jolivier23 jolivier23 deleted the jeffolivier/google/2.6 branch October 15, 2025 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

10 participants