Repository navigation
DAOS-17948 object: fix bugs for sgl duplicate logic - #16796
Conversation
|
Ticket title is 'Potential use-after-free for ec retry IO' |
wangshilong
changed the title
1. When IO retries occur, a use-after-free scenario may arise during scatter-gather list (sgl) merging. This happens because retried I/O's sgl references dup_sgls, which could be prematurely freed in obj_reasb_io_fini(). To fix above issue, processed_sgls must not be freed during retry operations and should be called only once per I/O operation. 2. If both short reads and duplicated SGLs occur, the iov_len of the original SGLs must be updated properly to ensure the correct number of read data bytes is returned. 3. Since only fetched data bytes are copied back, it is unnecessary to copy the original buffer to the merged buffer before fetching. 4. A test case has been added to verify that short reads function as expected during SGL merging. Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
864fc2b to
669ca6f
Compare
wangshilong
changed the title
|
Test stage Functional on EL 8.8 completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-16796/2/testReport/ |
Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
|
Test stage Test RPMs on EL 8.6 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-16796/4/display/redirect |
|
Test stage Test RPMs on EL 8.6 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-16796/6/display/redirect |
|
Test stage Functional on EL 8.8 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-16796/6/display/redirect |
| @@ -4907,6 +4907,7 @@ obj_dup_sgls_free(struct obj_auxi_args *obj_auxi) | |||
| d_sg_list_t *sg_orig = &ctx->sgls_orig[i]; | |||
| uint32_t dup_sg_idx = 0; | |||
| uint32_t dup_buf_size = 0; | |||
There was a problem hiding this comment.
so the dup_buf_size is only for sanity check after the change, right?
|
Test stage Functional Hardware Large MD on SSD completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-16796/10/execution/node/925/log |
Signed-off-by: Wang Shilong <shilong.wang@hpe.com>
5 participants
When IO retries occur, a use-after-free scenario may arise during
scatter-gather list (sgl) merging. This happens because retried I/O's
sgl references dup_sgls, which could be prematurely freed in obj_reasb_io_fini().
To fix above issue, dup_sgls must not be freed during retry operations
and should be called only once per I/O operation.
If both short reads and duplicated SGLs occur, the iov_len of the original
SGLs must be updated properly to ensure the correct number of read data bytes
is returned.
A test case has been added to verify that short reads function as expected during SGL merging.
Steps for the author:
After all prior steps are complete: