在基本快照api---hlfs_list_all_snapshots(...)中存在隐含的bug,
具体见如下分析
int hlfs_list_all_snapshots(const char *uri, char **ss_name_array) {
.....
if (0 > rewrite_snapshot_file(storage, ss_hashtable)) {
HLOG_ERROR("rewrite snapshot.txt error");
ret = -6;
goto out;
}
.....
}
int rewrite_snapshot_file(struct back_storage *storage, GHashTable
*ss_hashtable)
{
HLOG_DEBUG("enter func %s", __func__);
if((0 == storage->bs_file_is_exist(storage, SNAPSHOT_FILE)) &&
(0 > storage->bs_file_delete(storage, SNAPSHOT_FILE))) {
HLOG_ERROR("remove snapshot.txt failed");
return -1;
}
bs_file_t file = storage->bs_file_create(storage, SNAPSHOT_FILE);
if (file == NULL) {
HLOG_ERROR("create snapshot.txt error");
return -2;
}
storage->bs_file_close(storage, file);
GList *list = g_hash_table_get_values(ss_hashtable);
g_list_foreach(list, dump_ss_one_by_one, storage);
g_list_free(list);
HLOG_DEBUG("leave func %s", __func__);
return 0;
}
void dump_ss_one_by_one(gpointer data, gpointer storage)
{
HLOG_DEBUG("enter func %s", __func__);
if (NULL == data || NULL == storage) {
HLOG_ERROR("Param error");
return ;
}
struct snapshot *ss = (struct snapshot *) data;
char *file_name = SNAPSHOT_FILE;
if (0 > dump_snapshot((struct back_storage *)storage, file_name, ss)) {
HLOG_ERROR("dump ss error");
return ;
}
HLOG_DEBUG("leave func %s", __func__);
}
以上的hlfs_list_snapshots调用了rewrite_snapshot_file,rewrite_snapshot_fi
le调用dump_ss_one_by_one,dump_ss_one_by_one又调用了dump_snapshot,
这就出现了问题。对文件进行io操作,应该加锁的,但是这里
没有进行加锁。
hlfs_rm_snapshot也存在这个问题,我们必须都要上锁。
Original issue reported on code.google.com by
harryxi...@gmail.comon 6 Jan 2012 at 4:09