Skip to content

DDT: Add locking for table ZAP destruction - #18115

Merged
behlendorf merged 1 commit into
openzfs:masterfrom
amotin:ddt_objects_lock
Jan 13, 2026
Merged

DDT: Add locking for table ZAP destruction#18115
behlendorf merged 1 commit into
openzfs:masterfrom
amotin:ddt_objects_lock

Conversation

@amotin

@amotin amotin commented Jan 6, 2026

Copy link
Copy Markdown
Member

Similar to BRT, DDT ZAP can be destroyed by sync context when it becomes empty. Respectively similar to BRT introduce RW-lock to protect open context methods from the destruction.

How Has This Been Tested?

Without this patch I've seen one kernel panic in CI, probably triggered by #18047. Hope this to fix it.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Quality assurance (non-breaking change which makes the code more robust against bugs)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

@amotin amotin added the Status: Code Review Needed Ready for review and testing label Jan 8, 2026
behlendorf
behlendorf reviewed Jan 8, 2026
View reviewed changes
Comment thread module/zfs/ddt.c Outdated
@amotin
DDT: Add locking for table ZAP destruction
d95bb87 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Signed-off-by: Alexander Motin
@behlendorf behlendorf added Status: Accepted Ready to integrate (reviewed, tested) and removed Status: Code Review Needed Ready for review and testing labels Jan 9, 2026
@alek-p alek-p mentioned this pull request Jan 10, 2026
Open
alek-p added a commit to alek-p/openzfs that referenced this pull request Jan 12, 2026
@alek-p
DDT: Add locking for table ZAP destruction
8879da7 
Root Cause:
The DDT ZAP object can be destroyed by the sync context (ddt_sync_update_stats)
when a DDT class becomes empty. However, other threads might be accessing
this ZAP object concurrently (e.g. via ddt_object_lookup or zpool status -D)
without holding a lock that prevents the object's destruction. This leads to
a use-after-free and kernel panic.

Fix:
Introduce a Read-Write lock (ddt_op_lock) in the ddt_t structure.
- Writers (create/destroy) hold the lock exclusively.
- Readers (lookup/update/count/etc) hold it shared.
- This ensures the ZAP object remains valid while being accessed.

Closes: #20
Relates-to: openzfs#18115
Relates-to: openzfs#18062
Relates-to: openzfs#18052
Relates-to: openzfs#18008
@behlendorf
behlendorf merged commit 765929c into openzfs:master Jan 13, 2026
40 of 42 checks passed
@amotin
amotin deleted the ddt_objects_lock branch January 14, 2026 14:54
amotin added a commit to amotin/zfs that referenced this pull request Jan 29, 2026
@amotin
DDT: Add locking for table ZAP destruction
de0aad9 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
mcmilk pushed a commit to mcmilk/zfs that referenced this pull request Jan 31, 2026
@amotin @mcmilk
DDT: Add locking for table ZAP destruction
08ed761 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
amotin added a commit to amotin/zfs that referenced this pull request Feb 3, 2026
@amotin
DDT: Add locking for table ZAP destruction
f6b9a48 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
amotin added a commit to amotin/zfs that referenced this pull request Feb 3, 2026
@amotin
DDT: Add locking for table ZAP destruction
76f4ab2 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
lundman pushed a commit to openzfsonosx/openzfs-fork that referenced this pull request Feb 5, 2026
@amotin @lundman
DDT: Add locking for table ZAP destruction
7c0f1fb 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
tonyhutter pushed a commit that referenced this pull request Feb 5, 2026
@amotin @tonyhutter
DDT: Add locking for table ZAP destruction
2c9fec3 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes #18115
lundman pushed a commit to openzfsonwindows/openzfs that referenced this pull request Feb 23, 2026
@amotin @lundman
DDT: Add locking for table ZAP destruction
fb43bd1 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
lundman pushed a commit to openzfsonwindows/openzfs that referenced this pull request Feb 23, 2026
@amotin @lundman
DDT: Add locking for table ZAP destruction
ccaaa1c 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
snajpa pushed a commit to vpsfreecz/zfs that referenced this pull request Aug 5, 2026
@amotin @snajpa
DDT: Add locking for table ZAP destruction v2
9f77c31 
Similar to BRT, DDT ZAP can be destroyed by sync context when it
becomes empty.  Respectively similar to BRT introduce RW-lock to
protect open context methods from the destruction.

Reviewed-by: Brian Behlendorf 
Signed-off-by: Alexander Motin 
Closes openzfs#18115
Upstream: 765929c

Ported-by: Pavel Snajdr 

Porting-notes:

- Adapted table open and destroy paths to the object-ID-based DDT
  operation signatures used by 2.3.x.

Patch development history:
- v1: Upstream added a per-table read/write lock protecting DDT ZAP open
  contexts from concurrent destruction.
- v2: Adapted the locking change to the objset/object-based 2.3.x DDT
  operation signatures, which do not use the newer dnode-based
  interface.

Validation: The final corrected OpenZFS tree passed git diff --check,
  cstyle on changed C files, ksh syntax for the focused UID/GID-map ZTS,
  and a configured userland libzfs/zfs build. This message-only rewrite
  changes no source.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@behlendorf behlendorf behlendorf approved these changes

Assignees

No one assigned

Labels

Status: Accepted Ready to integrate (reviewed, tested)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@amotin @behlendorf