lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ha): close two independent chaotic-failover bugs — term-desync liveness stall and bug-847 WAL batch payload loss

Browse source 
Found via extended chaotic /xce-test-ha soaking on top of the bug-1419 fix
(same session). Both bugs independently caused the 10-round chaotic soak to
fail; sequential and chaotic now pass cleanly and repeatably.

1. Term-desync liveness deadlock (new): a standby that loses a near-
   simultaneous election race to a peer can legitimately end up at a HIGHER
   term than the peer that actually won and became primary. The primary's
   now-stale-term AppendEntries/heartbeats are correctly rejected by the raft
   library, but every one of those rejected messages was ALSO resetting the
   standby's own liveness deadline (ha_on_heartbeat_received), so its
   liveness timeout never fired and it could never start a fresh,
   higher-term election to let the cluster self-heal — a permanent stall.
   Fix: ha_msg_term_is_stale() gates the liveness reset (and
   ha_discover_primary step-down) on the incoming message's own term stamp,
   skipping it for provably-stale messages, in cluster.c's wal_catchup_entry
   and nop/heartbeat handlers.

2. bug-847 (root-caused 2026-06-30, never fixed): a per-sub-entry `payload`
   Data blob in a multi-entry WAL catch-up batch loses its capnp pointer once
   the message crosses a segment boundary — the receiver decodes
   raw_payload_len=0 for entries at/after the boundary and silently persists
   empty WAL entries (structurally intact: correct LSN/term/CRC chain, empty
   content). Only surfaces when a node rejoins and catches up a real batch,
   which is why it needed a live chaotic soak (not the 2-entry unit test) to
   reproduce. Fix: carry every sub-entry's payload concatenated in ONE
   top-level batchPayloads blob instead of one Data blob per entry — a
   single top-level blob does not exhibit the cross-segment loss. Sliced
   back apart on decode using each sub-entry's own wirePayloadLen, a plain
   scalar that (like lsn/entryType/term) decodes via the generic generated
   decode path and was never subject to the bug. Confirmed via targeted
   diagnostic logging that the corrupted entry arrives already-empty over
   the wire (not a receive-side race), and via a faithful reproduction at
   live JOB_SUBMIT payload size (5×3560B) after the original 2-entry/
   14×872B tests turned out not to cross a segment boundary in this
   environment.

Incidental fixes found and fixed along the way:
- A real self-deadlock (persist_entry_term() re-acquiring p->lock from
  inside a caller that already held it) introduced by an initial, ultimately
  unnecessary WAL-read locking fix attempted before bug-847 was pinned down;
  fixed via a new persist_entry_term_locked() lock-free counterpart. Left in
  place as a genuine (if incidental) hardening of ha_stream_wal_to_standby's
  read consistency.
- .claude/skills/xce-test-ha/SKILL.md's `context: fork` frontmatter caused
  the skill's own forked sub-session teardown to SIGHUP the whole
  xce_controller process group mid-soak, killing all 3 nodes silently with
  no error logged, whenever the soak was launched via the Skill tool itself
  (setsid/nohup inside run-ha-soak.sh only protects against a controlling
  terminal's own SIGHUP, not a parent forked-session's teardown). Removed;
  added explicit guidance to launch long soaks via direct Bash from the main
  session instead.

Verified: full 78-group unit regression sweep clean (0 failures) after each
change; two consecutive clean 10-round chaotic soaks and one clean 10-round
sequential soak on the final binary (zero committed divergence, zero job
loss, all 3 nodes led in both modes).
This commit is contained in:
Rongsong Shen 2026-07-08 15:21:24 +00:00
parent 11244dd654
commit 0941cf9649
11 changed files with 295 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

99
src/controller/config_repl.c
View file

@ -2151,6 +2151,66 @@ static int stream_read_entry_body(int fd, uint32_t body_off,
return 0;
}
/* raft-ha-core-safety task 2.5 (send-side torn-read guard): read ONE WAL
* entry's header + (if payload_len>0) full body while holding p->lock, so this
* read observes a consistent snapshot with respect to a CONCURRENT write to
* the SAME file -- persist_wal_write_replicated (and the primary's own append
* path) write under p->lock, but this function's reads previously ran lock-
* free, so a node that is simultaneously receiving new entries from its own
* upstream leader AND streaming older entries downstream to a catching-up
* standby could observe the downstream read torn: a committed entry with a
* real non-empty payload on disk read back with a short/zero payload_len or a
* partially-written body, then faithfully shipped and persisted downstream as
* empty -- a genuine committed-prefix divergence at a historical LSN (not the
* already-guarded body-short-read case in stream_read_entry_body, which
* assumes a syntactically valid header; this closes the header-itself-torn
* gap). Held only for one entry's read, not the whole stream, so a long catch-
* up does not block writers throughout. p may be NULL only in count-only
* tests (no live writer to race against).
*
* Returns 0 on success (*hdr_out populated; *payload_out set iff
* hdr_out->payload_len > 0), -1 on a short/EOF header read (caller treats as
* "nothing more in this segment"), or stream_read_entry_body's negative rc on
* a body-read failure (caller aborts the stream, per its own fail-loud
* contract). */
static int read_one_wal_entry_locked(int fd, uint32_t off, const persist_t *p,
uint64_t leader_term, uint64_t standby_lsn,
wal_entry_hdr_t *hdr_out,
uint8_t **payload_out)
{
pthread_mutex_t *lk = p ? (pthread_mutex_t *)&p->lock : NULL;
*payload_out = NULL;
if (lk)
pthread_mutex_lock(lk);
ssize_t n = pread(fd, hdr_out, sizeof(*hdr_out), (off_t)off);
if (n < (ssize_t)sizeof(*hdr_out)) {
if (lk)
pthread_mutex_unlock(lk);
return -1;
}
int rc = 0;
/* Only entries actually being streamed (above standby_lsn) need their
* body read at all -- matches the caller's own send-vs-scan-only split,
* so this fix does not add wasted I/O for the already-acked prefix. */
if (hdr_out->payload_len > 0 && hdr_out->lsn > standby_lsn) {
/* p->lock is already held here -- persist_entry_term() would
* re-acquire it and self-deadlock; persist_entry_term_locked() is
* the lock-free counterpart for exactly this case. */
uint64_t stored_term = p ? persist_entry_term_locked(p, hdr_out->lsn)
: hdr_out->term;
rc = stream_read_entry_body(fd, off + (uint32_t)sizeof(*hdr_out),
hdr_out->payload_len, hdr_out->lsn,
stored_term, leader_term, payload_out);
}
if (lk)
pthread_mutex_unlock(lk);
return rc;
}
int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
const persist_t *p, uint64_t leader_term,
uint64_t standby_lsn, uint64_t committed_lsn)
@ -2222,10 +2282,19 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
uint32_t off = 0;
for (;;) {
wal_entry_hdr_t hdr;
ssize_t n = pread(fd, &hdr, sizeof(hdr), (off_t)off);
if (n < (ssize_t)sizeof(hdr)) break;
if (hdr.lsn == 0 && hdr.type == 0 && hdr.payload_len == 0) break;
if (hdr.lsn > committed_lsn) break;
uint8_t *locked_pbuf = NULL;
int rrc0 = read_one_wal_entry_locked(fd, off, p, leader_term,
standby_lsn, &hdr,
&locked_pbuf);
if (rrc0 == -1) break; /* short/EOF header read */
if (hdr.lsn == 0 && hdr.type == 0 && hdr.payload_len == 0) {
free(locked_pbuf);
break;
}
if (hdr.lsn > committed_lsn) {
free(locked_pbuf);
break;
}
/* WAL_CHECKPOINT is a local-only marker (persist_write_checkpoint_
* marker's own doc comment: "replay_wal SKIPS checkpoint markers...
@ -2242,6 +2311,7 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
* Without this, a standby receiving one gets stuck retrying the
* same LSN forever (the receive-side guard correctly refuses it). */
if (hdr.type == WAL_CHECKPOINT) {
free(locked_pbuf);
off += (uint32_t)(sizeof(hdr) + hdr.payload_len);
continue;
}
@ -2249,6 +2319,7 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
if (hdr.lsn > standby_lsn) {
wal_catchup_entry_t *entry = calloc(1, sizeof(*entry));
if (!entry) {
free(locked_pbuf);
/* OOM: flush current batch and skip this entry */
if (batch_n > 0) {
send_wal_batch(ep, batch_entries, batch_n);
@ -2293,14 +2364,13 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
entry->leader_current_term = leader_term;
if (hdr.payload_len > 0) {
/* raft-ha-core-safety task 2.4: read the body with bounded
* retry; a non-empty COMMITTED entry must NEVER be shipped
* empty (the live LSN-9 send-side payload loss). */
uint8_t *pbuf = NULL;
int rrc = stream_read_entry_body(
fd, off + (uint32_t)sizeof(hdr), hdr.payload_len,
hdr.lsn, entry->term, leader_term, &pbuf);
if (rrc != 0) {
/* raft-ha-core-safety task 2.4/2.5: the body was already
* read (with bounded retry) by read_one_wal_entry_locked
* above, under the SAME lock as the header -- a non-empty
* COMMITTED entry must NEVER be shipped empty, whether from
* a short body read (task 2.4) or a header/body torn read
* racing a concurrent write to this same file (task 2.5). */
if (rrc0 != 0) {
/* FAIL LOUD: the body could not be read in full after the
* bounded retry. Do NOT degrade the entry to PLEN=0 —
* abort the stream here. Flush the valid prefix already
@ -2319,8 +2389,9 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
"non-empty committed entry must never be transmitted "
"as PLEN=0; catch-up will re-stream from this LSN)",
hdr.lsn, hdr.payload_len, entry->term, leader_term,
rrc, WAL_STREAM_BODY_READ_MAX_ATTEMPTS);
rrc0, WAL_STREAM_BODY_READ_MAX_ATTEMPTS);
free(entry);
free(locked_pbuf);
if (batch_n > 0) {
send_wal_batch(ep, batch_entries, batch_n);
for (int bi = 0; bi < batch_n; bi++) {
@ -2333,7 +2404,7 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
close(fd);
return -EIO;
}
entry->raw_payload = pbuf;
entry->raw_payload = locked_pbuf;
entry->raw_payload_len = hdr.payload_len;
}