Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix block-boundary truncate issues #800

Merged
merged 5 commits into from
Apr 26, 2023
Merged

Fix block-boundary truncate issues #800

merged 5 commits into from
Apr 26, 2023

Conversation

geky
Copy link
Member

@geky geky commented Apr 17, 2023

Building on the work from @colin-foster-in-advantage, @rvanschoren, and @hgspbs, I believe this fixes #732, #268, and likely others.

Long story short, lfs_file_truncate has had a bug for a while where truncates to block boundaries (after adjusting for CTZ skip-list metadata) would corrupt the internal state of the CTZ skip-list.

This fix started with @colin-foster-in-advantage's test case that made it easy to reproduce the issue, but I've taken the idea and expanded the existing truncate tests to cover both this and other possible off-by-one issues.

A deeper explanation for this bug follows.


There has been a bug in the filesystem for a while where truncating to a block boundary suffers from an off-by-one mistake that corrupts the internal representation of the CTZ skip-list.

This mostly appears when the file_size == block_size, as file_size > block_size includes CTZ skip-list metadata, so the underlying block boundaries appear at slightly different offsets.

The reason for off-by-one issue is a nuance in lfs_ctz_find that we sort of abuse to get two different behaviors.

Consider the situation where this bug occurs:

 block 0     block 1
.--------.  .--------.
| abcdef |<-| {ptr0} |
| ghijkl |  | yzabcd |
| mnopqr |  |        |
| stuvwx |  |        |
'--------'  '--------'

With these 24-byte blocks, there's an ambiguity if we wanted to point to offset 24. We could point before the block boundary, or we could point after the block boundary.

Before:

 block 0     block 1
.--------.  .--------.
| abcdef |<-| {ptr0} |
| ghijkl |  | yzabcd |
| mnopqr |  |        |
| stuvwx |  |        |
'-------^'  '--------'
        '-- off=24 is here

After:

   block 0     block 1
  .--------.  .--------.
  | abcdef |<-| {ptr0} |
  | ghijkl |  | yzabcd |
  | mnopqr |  | ^      |
  | stuvwx |  | |      |
  '--------'  '-|------'
                '-- off=24 is here

When we want these two offsets depends on the context. We want the offset to be conservative if it represents a size, but eager if it is being used to prepare a block for writing.

The workaround/hack is to prefer the eager offset, after the block boundary, but use size-1 as the argument if we need the conservative offset.

This finds the correct block, but is off-by-one in the calculated block-offset. Fortunately we happen to not use the block-offset in the places we need this workaround/hack.


To get back to the bug, the wrong mode of lfs_ctz_find was used in lfs_file_truncate, leading to internal corruption of the CTZ skip-list.

The correct behavior is size-1, with care to avoid underflow.

Also I've tweaked the code to make it clear the calculated block-offset goes unused in these situations.


Thanks to @ghost, @ajaybhargav, and others for reporting the issue, @colin-foster-in-advantage for a reproducible test case, and @rvanschoren, @hgspbs for the initial solution.

Let me know if anyone sees issues with the fix proposed here. Otherwise I'll bring it in on the next release.

When truncation is done on a file to the block size, there seems to be
an error where it points to an incorrect block. Perform a write /
truncate / readback operation to verify this issue.

Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
Removed the weird alignment requirement from the general truncate tests.
This explicitly hid off-by-one truncation errors.

These tests now reveal the same issue as the block-sized truncation test
while also testing for other potential off-by-one errors.
There has been a bug in the filesystem for a while where truncating to a
block boundary suffers from an off-by-one mistake that corrupts the
internal representation of the CTZ skip-list.

This mostly appears when the file_size == block_size, as file_size >
block_size includes CTZ skip-list metadata, so the underlying block
boundaries appear at slightly different offsets.

---

The reason for off-by-one issue is a nuance in lfs_ctz_find that we sort
of abuse to get two different behaviors.

Consider the situation where this bug occurs:

   block 0     block 1
  .--------.  .--------.
  | abcdef |<-| {ptr0} |
  | ghijkl |  | yzabcd |
  | mnopqr |  |        |
  | stuvwx |  |        |
  '--------'  '--------'

With these 24-byte blocks, there's an ambiguity if we wanted to point to
offset 24. We could point before the block boundary, or we could point
after the block boundary

Before:

   block 0     block 1
  .--------.  .--------.
  | abcdef |<-| {ptr0} |
  | ghijkl |  | yzabcd |
  | mnopqr |  |        |
  | stuvwx |  |        |
  '-------^'  '--------'
          '-- off=24 is here

After:

   block 0     block 1
  .--------.  .--------.
  | abcdef |<-| {ptr0} |
  | ghijkl |  | yzabcd |
  | mnopqr |  | ^      |
  | stuvwx |  | |      |
  '--------'  '-|------'
                '-- off=24 is here

When we want these two offsets depends on the context. We want the
offset to be conservative if it represents a size, but eager if it is
being used to prepare a block for writing.

The workaround/hack is to prefer the eager offset, after the block boundary,
but use `size-1` as the argument if we need the conservative offset.

This finds the correct block, but is off-by-one in the calculated
block-offset. Fortunately we happen to not use the block-offset in the
places we need this workaround/hack.

---

To get back to the bug, the wrong mode of lfs_ctz_find was used in
lfs_file_truncate, leading to internal corruption of the CTZ skip-list.

The correct behavior is size-1, with care to avoid underflow.

Also I've tweaked the code to make it clear the calculated block-offset
goes unused in these situations.

Thanks to ghost, ajaybhargav, and others for reporting the issue,
colin-foster-advantage for a reproducible test case, and rvanschoren,
hgspbs for the initial solution.
Before, once converted to a CTZ skip-list, a file would remain a CTZ
skip-list even if truncated back to a size that could be inlined.

This was just a shortcut in implementation. And since the fix for boundary
truncates needed special handling for size==0, it made sense to extend
this special condition to allow reverting to inline files.

---

The only case I can think of, where reverting to an inline file would be
detrimental, is if it's a readonly file that you would otherwise not need
to pay the metadata overhead for. But as a tradeoff, inlining the file
would free up the block it was on, so it's unclear if this really is
a net loss.

If the truncate is followed by a write, reverting to an inline file will
always be beneficial. We assume writes will change the data, so in the
non-inlined case there's no way to avoid copying the underlying block.
Even if we assume padding issues are solved.
@geky
Copy link
Member Author

geky commented Apr 17, 2023

Normally I would separate out the "revert-to-inline" feature to a separate PR, but the next release will be a minor one anyways.

If that ends up taking to long I'll separate the commits to bring this in on a patch release.

@geky geky added this to the v2.6 milestone Apr 17, 2023
@geky geky removed the needs ci ci is probably broken label Apr 18, 2023
@geky geky changed the base branch from master to devel April 26, 2023 06:04
@geky geky merged commit 23a4a08 into devel Apr 26, 2023
@geky geky mentioned this pull request May 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Bug in lfs_file_truncate
2 participants