Аудит от GPT-5-5 от fox - для истории #76
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Audit Result
Read-only audit of commit
c16f955a519ecce39c2538a9b1ffde36d3133b71, excluding KV, NFS, NBD, and ublk. No builds, tests, edits, or artifacts.13 CONFIRMED, 3 NEEDS MORE CONTEXT, 0 FALSE POSITIVES. Every finding received independent devil’s-advocate and exploit-scenario review.
Critical Findings
Parity-less degraded EC writes destroy allocation bitmaps — CONFIRMED. Partial writes with all parity roles absent replace surviving-role bitmaps with mostly zero data, causing subsequent reads to return parent/zero instead of existing bytes. Deterministic under this geometry. osd_rmw.cpp, osd_primary_subops.cpp, blockstore_heap.cpp
ISA-L decoder cache hits use zero row stride — CONFIRMED.
item_sizeis initialized only on cache misses; later degraded reads with multiple missing data roles can decode using the wrong matrix row. This silently returns or persists a valid but incorrect codeword. osd_rmw.cpp, osd_rmw.cppSYNC can acknowledge metadata not covered by any flush — CONFIRMED. A metadata write may complete after an earlier fsync while SYNC has already cleared its dirty counter; a later journal-only SYNC can then mark the associated LSN durable. Power loss can lose acknowledged writes or resurrect deletes. blockstore_write.cpp, blockstore_impl.cpp, blockstore_sync.cpp
Legacy concurrent read/flush frees the wrong allocator block — CONFIRMED. The read path stores a byte offset but later passes it as a block index. A different live object can be freed and overwritten while its metadata continues referencing that block. read.cpp, flush.cpp, allocator.cpp
All metadata formats publish the header before clearing old metadata — CONFIRMED. A crash during initialization leaves a valid new header over stale CRC-valid entries. Restart can load phantom objects and promote stale high-LSN versions. blockstore_init.cpp, v1/init.cpp, disk_tool_prepare.cpp
Checksum compaction blesses latent corruption — CONFIRMED. Partial checksum-block updates intentionally skip validation of untouched old bytes; compaction recalculates and persists checksums over those bytes. Existing corruption consequently becomes permanently checksum-valid. blockstore_read.cpp, blockstore_flush.cpp, blockstore_heap.cpp
Legacy journal flushing launders corrupted data — CONFIRMED. Format-2 detects journal corruption but then writes the mutated buffer into the data area and generates matching metadata checksums. Future reads accept the corruption. v1/flush.cpp, v1/flush.cpp
Unstable deletes are omitted from replay and falsely synchronized — CONFIRMED. Zero-length deletes are absent from the write cache; after primary disconnection, SYNC removes the OSD from
dirty_osdsand succeeds without replaying the delete. Power loss can resurrect the old object. cluster_client.cpp, cluster_client_wb.cppScrub-known inconsistent replicas remain readable — CONFIRMED. Scrub records the inconsistency, but normal read placement ignores that state and returns whichever same-version replica is selected. Different primaries may silently return different payloads. osd_scrub.cpp, osd_primary.cpp, osd_primary_subops.cpp
Writeback mode treats DELETE as a successful no-op — CONFIRMED. A zero-length delete returns success without recording or sending anything. Every delete under the affected configuration leaves the original object present. cluster_client.cpp, cluster_client_wb.cpp
High Findings
Degraded EC scrub writes beyond its heap allocation — CONFIRMED. When
k < live roles < n, temporary stripes are allocated by compact count but indexed by original role. Example: EC 4+2 with five live roles deterministically corrupts heap memory. osd_rmw.cpp, osd_rmw.cpp, osd_scrub.cppScrub never compares external allocation bitmaps — CONFIRMED. Replicas with identical bytes but divergent logical-allocation metadata pass scrub. Chained and snapshot reads can therefore return different parent, zero, or local data without detection. osd_scrub.cpp, osd_rmw.cpp
Repeated scrub clears known corruption — CONFIRMED. A still-failing replica already marked
LOC_CORRUPTEDcan enter the clearing path on the next scrub. EC compact indexing can additionally access outside the stripe array. osd_scrub.cppNeeds More Context
Torn format-3 metadata blocks. The format lacks block-level generation/COW protection and can accept a valid old/new sector mixture. Verdict depends on the cloud volume’s power-loss atomic write unit. blockstore_heap.cpp
Positive short initialization I/O. All formats accept any nonnegative result as complete. Confirming production reachability requires the kernel, device driver, and cloud-volume short-I/O guarantees. blockstore_init.cpp, v1/init.cpp
Public C deletion API hides
LEFT_ON_DEAD. Stale-copy resurrection is possible if the external metadata consumer treats success as an atomic tombstone, but that consumer is outside this repository. vitastor_c.cpp, osd_primary.cppLinux ordering basis for finding 3: writeback cache controls, dm-log-writes ordering.
Итог:
Мега годный анализ.
Не подтверждены пункты 3, 6, 8, 9, 10, 14, 16.
Всё остальное очень годное, особенно мне понравилось замечание про то, что скрабы не проверяли битмапы.
Всё исправлено и закоммичено, написаны регрессионные тесты, пойманы дополнительные баги по цепочке и тоже исправлены.))