From: | Thomas Munro <thomas(dot)munro(at)gmail(dot)com> |
---|---|
To: | pgsql-hackers(at)postgresql(dot)org |
Subject: | Re: Some thoughts on NFS |
Date: | 2019-02-19 22:08:45 |
Message-ID: | CA+hUKG+8gwcAMOWOM=CNg8kJ-7BEeZZjj1_KC++rQ9YQcoFikA@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Tue, Feb 19, 2019 at 8:03 PM Thomas Munro <thomas(dot)munro(at)gmail(dot)com> wrote:
> A theoretical question I thought of is whether there are any
> interleavings of operations that allow a checkpoint to complete
> bogusly, while a concurrent close() in a regular backend fails with
> EIO for data that was included in the checkpoint, and panics. I
> *suspect* the answer is that every interleaving is safe for 4.16+
> kernels that report IO errors to every descriptor. In older kernels I
> wonder if there could be a schedule where an arbitrary backend eats
> the error while closing, then the checkpointer calls fsync()
> successfully and then logs a checkpoint, and then then the arbitrary
> backend panics (too late). I suspect EIO on close() doesn't happen in
> practice on regular local filesystems, which is why I mention it in
> the context of NFS, but I could be wrong about that.
Ugh. It looks like Linux NFS doesn't even use the new errseq_t
machinery in 4.16+. So even if we had the fd-passing patch, I think
there may be a dangerous schedule like this:
A: close() -> EIO, clears AS_EIO flag
B: fsync() -> SUCCESS, log a checkpoint
A: panic! (but it's too late, we already logged a checkpoint but
didn't flush all the dirty data the belonged to it)
--
Thomas Munro
https://enterprisedb.com
From | Date | Subject | |
---|---|---|---|
Next Message | Thomas Munro | 2019-02-19 22:25:22 | Re: Some thoughts on NFS |
Previous Message | Tom Lane | 2019-02-19 21:48:55 | Another way to fix inherited UPDATE/DELETE |