Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

backupccl: reintroduce previously offline tables with manifest.DescriptorChanges #89981

Merged
merged 1 commit into from
Oct 20, 2022

Conversation

msbutler
Copy link
Collaborator

@msbutler msbutler commented Oct 14, 2022

getReintroducedSpans finds all tables included in the current and previous
backup that may have undergone a non-mvcc operation. The current backup will
then back up these tables' spans from ts = 0, as the previous backup may have
missed certain non-mvcc operations (e.g. ClearRange, non-mvcc AddSSTable).

To find these tables, getReintroducedSpans must find all tables covered in the
previous backup that were in the offline state at previous backup start time.

This function assumed that the previous backup's
manifest.Descriptors field would contain all tables covered in the previous
backup; however, while investigating #88042, we discovered that this assumption
is not correct in pre 22.2 branches. During revision history backups, a table
with an in-progress import (e.g. offline at backup time) can get backed up and
included in manifest.DescriptorChanges but not in manifest.Descriptors. This
implies getReintroducedSpans missed reintroducing spans from this table,
implying that backup chains have missed backing up some data.

It's worth noting this bug could only affect a backup chain post 22.1 iff the
backup that observed the table go offline was taken on a 22.1
cluster. Because post 22.1 backups explicitly back up all offline tables, all tables
in manifest.DescriptorChanges should also be in manifest.Descriptors. In other
words, before this patch, the following sequence could lead to a corrupt backup
chain:

  • t0: begin IMPORT on foo, on a pre 22.2 cluster
  • t1: conduct a revision history backup of foo
  • t2: complete or cancel the import of foo, via a non-mvcc operation
  • t3: upgrade the cluster to 22.2 or later
  • t4: conduct a revision history incremental backup of foo
    • foo's span will not get re-introduced

This patch fixes getReintroducedSpans to ensure it reintroduces tables included
in manifest.DescriptorChanges whose last revision brought the table offline. In
addition, this patch adds a check to restore planning which causes the restore
to fail immedidiately if any restore target is missing an introduced span. The
patch tests this check on a corrupt backup taken on v21.2.

Fixes #88042

Release note(bug fix): fix apart of Tech Advisory
https://cockroachlabs.atlassian.net/browse/TSE-198

@msbutler msbutler self-assigned this Oct 14, 2022
@cockroach-teamcity
Copy link
Member

This change is Reviewable

@msbutler msbutler force-pushed the butler-master-reintro branch from a61551e to f23ce37 Compare October 14, 2022 16:37
@msbutler msbutler changed the title Butler master reintro backupccl: reintroduce previously offline tables with manifest.DescriptorChanges Oct 14, 2022
@msbutler msbutler marked this pull request as ready for review October 14, 2022 18:05
@msbutler msbutler requested a review from a team as a code owner October 14, 2022 18:05
@msbutler msbutler requested review from rhu713, stevendanna and dt and removed request for a team and rhu713 October 14, 2022 18:05
@msbutler
Copy link
Collaborator Author

this is a trivial forward port of the 22.2 patch to master. just needs a stamp!

@msbutler
Copy link
Collaborator Author

TFTR!

bors r=stevendanna

@craig
Copy link
Contributor

craig bot commented Oct 19, 2022

Build failed:

@msbutler
Copy link
Collaborator Author

bor r-

@msbutler
Copy link
Collaborator Author

bors r-

…ptorChanges

getReintroducedSpans finds all tables included in the current and previous
backup that may have undergone a non-mvcc operation. The current backup will
then back up these tables' spans from ts = 0, as the previous backup may have
missed certain non-mvcc operations (e.g. ClearRange, non-mvcc AddSSTable).

To find these tables, getReintroducedSpans must find all tables covered in the
previous backup that were in the offline state at previous backup start time.

This function assumed that the previous backup's
manifest.Descriptors field would contain all tables covered in the previous
backup; however, while investigating cockroachdb#88042, we discovered that this assumption
is not correct in pre 22.2 branches. During revision history backups, a table
with an in-progress import (e.g. offline at backup time) can get backed up and
included in manifest.DescriptorChanges but not in manifest.Descriptors. This
implies getReintroducedSpans missed reintroducing spans from this table,
implying that backup chains have missed backing up some data.

It's worth noting this bug could only affect a backup chain in 22.2 iff the
backup that observed the table go offline was taken on a 22.1
cluster. Because 22.2 backups explicitly back up all offline tables, all tables
in manifest.DescriptorChanges should also be in manifest.Descriptors. In other
words, before this patch, the following sequence could lead to a corrupt backup
chain:
- t0: begin IMPORT on foo, on a pre 22.2 cluster
- t1: conduct a revision history backup of foo
- t2: complete or cancel the import of foo, via a non-mvcc operation
- t3: upgrade the cluster to 22.2
- t4: conduct a revision history incremental backup of foo
     - foo's span will not get re-introduced

This patch fixes getReintroducedSpans to ensure it reintroduces tables included
in manifest.DescriptorChanges whose last revision brought the table offline. In
addition, this patch adds a check to restore planning which causes the restore
to fail immedidiately if any restore target is missing an introduced span. The
patch tests this check on a corrupt backup taken on v21.2.

Release note(bug fix): fix apart of Tech Advisory
https://cockroachlabs.atlassian.net/browse/TSE-198

Release justification: bug fix
@msbutler msbutler force-pushed the butler-master-reintro branch from f23ce37 to d80f505 Compare October 20, 2022 15:39
@msbutler
Copy link
Collaborator Author

bors r=adityamaru

@craig
Copy link
Contributor

craig bot commented Oct 20, 2022

Build succeeded:

@craig craig bot merged commit 72ac655 into cockroachdb:master Oct 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

backupccl: offline table data in revision history backups can leak into restored cluster
3 participants