[pbs-devel] [PATCH proxmox-backup v2 0/3] fix GC atime update race window

[Christian Ebner]

Sweeping of unused chunks during garbage collection checks their
atime to distinguish between chunks being in-use and chunks no
longer being used. While garbage collection does lock the chunk
store by guarding its mutex before reading file stats and deleting
unused chunks, the conditional touch did not do this before updating
the chunks atime (thereby also checking the presence).

Therefore there is a race window between the chunks metadata being
read and the chunk being removed, but the chunk being touched
in-between.

The race is however rare, as for this to happen the chunk must be
older than the cutoff time and not be referenced by any index file,
otherwise the atime would be updated during phase 1 already.

Fix by guarding the chunk store mutex before touching a chunk.

Lastly, also make sure that marker chunk inserts and atime updates
on bad chunks are performed in a locked context as well.

Changes since version 1 (thanks @Fabian for swiftly seeing the issues):
- Limit helpers scope for better encapsulation
- Make sure internal helpers do not try to lock the chunk store again
- Assure the chunk store is locked for s3 local store cache marker file
  insertion and atime updates on bad chunks.

Christian Ebner (3):
  chunk store: limit scope for atime update helper methods
  chunk store: fix race window between chunk stat and gc cleanup
  datastore: insert chunk marker and touch bad chunks in locked context

 pbs-datastore/src/chunk_store.rs | 48 +++++++++++++++++++++++++++-----
 pbs-datastore/src/datastore.rs   | 42 +++++++++++++++++-----------
 2 files changed, 66 insertions(+), 24 deletions(-)

-- 
2.47.3