-
Notifications
You must be signed in to change notification settings - Fork 640
storage: fix index state truncate overflow #26051
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
storage: fix index state truncate overflow #26051
Conversation
Don't love the approach, open to alternative suggestions. |
Similar to redpanda-data#25979, when an index contains state that leads it to overflow, it is unreliable. In this case, this could affect truncation, and result in us removing incorrect index entries. So, this makes the truncate avoid removing entries if this case is detected, with the expectation that no entries are added that have overflowed. Note, this bug doesn't appear to be as severe as redpanda-data#25979 in that: - suffix truncation is generally more rare - the overflowing index problem is generally a problem with: - large segments, much larger than the default allowed size - compacted segments, which we expect to be relatively rare to suffix truncate with tiered storage Nonetheless, some kind of fix seems appropriate because it's difficult to reason about the overflow otherwise.
7e18ed3
to
e882d67
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm .. not too familiar with this code but looks correct to me .. would prefer another pair of 👓
CI test resultstest results on build#65554
|
// added to the index, unless by an older buggy version of Redpanda. | ||
// With this in mind, either there are no entries above u32_max, or | ||
// offset_lower_bound() isn't going to work correctly anyway, so we just | ||
// skip removal and rely on queries to detect the overflow. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
so we just skip removal and rely on queries to detect the overflow.
i'm not clear on what this means or how it works. the confusion i have is something like: if the truncation request is legit, but we ignore it because of the overflow, then how do we know that a later query would not be affected by having dropped a truncation request? presumably we rely on suffix truncation for raft correctness?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The idea is that if entries aren't truncated here, it's because we are attempting to truncate to something beyond the uint32 delta limit. If that's the case:
- there should be no such entries in the index, and
- queries for beyond that limit should skip the binary search
Does that answer your question? Or are you getting at that there's still an edge case where a later query returns the wrong thing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i think it looks ok. i'm less concerned about my question after read it again today
/backport v25.1.x |
/backport v24.3.x |
/backport v24.2.x |
Failed to create a backport PR to v24.2.x branch. I tried:
|
Failed to create a backport PR to v25.1.x branch. I tried:
|
Failed to create a backport PR to v24.3.x branch. I tried:
|
Similar to #25979, when an index contains state that leads it to overflow, it is unreliable. In this case, this could affect truncation, and result in us removing incorrect index entries.
So, this makes the truncate avoid removing entries if this case is detected, with the expectation that no entries are added that have overflowed.
Note, this bug doesn't appear to be as severe as #25979 in that:
Nonetheless, some kind of fix seems appropriate because it's difficult to reason about the overflow otherwise.
Backports Required
Release Notes