ChangeLog

Latest:
------
 For even more detail, use "git log" or visit https://github.com/LINBIT/drbd/commits/master.

9.3.4 (api:genl2/proto:86-101,118-125/transport:22)
--------
 * Fix drbdsetup failing with "Operation not supported" on every command
   that names a peer; a regression of the YNL-generated netlink code in
   9.3.4-rc.1
 * Generate the netlink interface code with the upstream YNL generator
   instead of the genl_magic macro system
 * Fix a ProtocolError disconnect loop ("BAD! BarrierAck received with
   n_writes=...") when two volumes of one connection replicate and
   resync without replication at the same time
 * Tolerate a verify-alg mismatch when connecting, and refuse to start
   an online verify while the algorithms differ, instead of rejecting
   the connection outright
 * Fix several bitmap lifetime bugs around attach and detach: a NULL
   bitmap dereference in the peer device statistics, a missing bitmap
   in drbd_set_sync(), concurrent drbd_bm_free() callers, and freeing
   a bitmap that a later attach published
 * Fix a device reference leak and a NULL pointer dereference when a
   peer request's bio allocation fails under memory pressure
 * Hold state_rwlock while walking the transfer log from debugfs
 * All fixes from 9.2.20
  - Fix a secondary that stayed with the primary ending up Outdated for
    good after an isolated peer returns: an equal-UUID reconcile is now
    sourced from the node that has a primary neighbour
  - Fix two nodes ending UpToDate with different data after a reconnect
    with equal current UUIDs and out-of-sync bits standing: such bits now
    survive a resync-free connect and drive a reconciliation resync
  - Fix divergence around the end of a resync
  - Fix a node losing its obligation to start a new data generation and
    ending in a split brain
  - Fix a number of aspects of online resize
  - Fix a sync target overwriting acknowledged writes with older resync
    data when the sync source lost the diskless primary; such writes are
    now held back or postponed (new feature flag WRITE_POSTPONE) instead
    of being silently rolled back
  - Fix data corruption when a peer bitmap that is being cleared by a
    running resync was copied for a second peer
  - Fix several ways a Primary lost its obligation to start a new data
    generation after losing a peer, each ending in silent divergence,
    and a spurious I/O error when a deferred generation resumes; the
    obligation is now tracked per volume and logged
  - Fix a diskless Primary losing a peer: rotate the current UUID so the
    stale peer resyncs on return, outdate far-away members before
    resuming I/O, and keep the sole UpToDate survivor UpToDate; also
    fixes promotions freezing I/O on nodes not connected to every member
  - Fix a resync target ending with stale data or an old data generation
    when a crashed primary rejoins or a diskless primary announces a new
    generation mid-resync
  - Fix al-updates=no: honour it at attach time, and mark all bitmap
    slots out of sync after a primary crash
  - Fix kernel memory corruption by a malicious or man-in-the-middle
    peer sending out-of-range payload, drain or digest sizes, and a
    divide error caused by bogus peer block sizes
  - Fix a use-after-free of the resource when a connections dump is
    interrupted, and a refcount imbalance flooding the log with put_ldev
    assertions after a resync request allocation failure
  - Fix soft lockups: the sender thread pinning a CPU while its
    connection is down, and IRQ-disabled bitmap scans on multi-TiB
    volumes
  - Fix several deadlocks and hangs: whole-bitmap IO vs clear_peer_slot()
    or online resize, WFBitMapS on an equal-UUID reconnect with leftover
    out-of-sync bits, demotion starved by a failing connect handshake,
    and connection teardown blocked behind an unacknowledged resync
    conflict
  - Fix many two-phase-commit issues: stale replies answering the wrong
    transaction, prepared peers that disconnected, forwarding node
    handling, a state_sem leak on timeout, and unbounded connect
    retries; log which volume a connect is waiting for
  - Fix resyncs stalling short of completion, and a connection dropping
    to StandAlone when a crashed primary rejoins during a resync
  - Fix drbd_suspend_io() not waiting for in-flight writes; a detach
    hanging on a dead backing device stays interruptible
  - Fix restoring quorum after a reboot when the remaining members are
    diskless
  - Fix connection losses: online resize ending in ProtocolError,
    volume-less connections reconnecting every ping-timeout, lb-tcp
    "drbdadm down" stalling for a connect-int, and a TLS control socket
    close going unnoticed
  - Declare a connection broken where a two-phase-commit send failed,
    and repeat a disconnect without delay and with a bound; together
    they end a hanging "drbdadm disconnect"
  - Do not account requests as waiting for the activity log while it is
    suspended; the stale counters throttled resync to c-min-rate and
    drained the epoch for every incoming peer write

9.3.3 (api:genl2/proto:86-101,118-124/transport:22)
--------
 * Support adding and removing paths on established lb-tcp connections
 * Fix a page-reference leak on TLS connections by copying instead of
   referencing pages when sending
 * Reject paths that would make incoming connections ambiguous
 * All fixes from 9.2.19
  - Fix silent data divergence when a diskless primary creates a new
    current UUID that a peer never received (e.g. switch failure);
    the optimistic UUID is now confirmed via the data stream before
    being relied upon
  - Fix silent data corruption when a diskless primary suppressed its
    current-UUID bump because a peer had been resynced by a third node
  - Fix a false split-brain ("Unrelated data, aborting!") caused by
    pushing a peer's bitmap UUIDs into the local history
  - Hold a primary-loss survivor at Consistent until it reconciles with
    the surviving peers, so a stale node cannot promote and serve
    un-reconciled data
  - Reconcile two peers holding the same current UUID but still carrying
    out-of-sync bits toward each other, instead of silently dropping the
    divergence
  - Fix a list corruption crash when freeing a peer_req that was
    still linked on the send_oos list
  - Fix an AB-BA deadlock between online resize and activity-log
    transactions
  - Fix a use-after-free of the TCP listener during connection setup
  - Fix a list corruption crash and assertion failures when a peer
    disconnects while online-verify requests are still in flight
  - Fix several races during connection teardown that could crash or
    hang (ack_sender requeue, pending ping work, in-progress lb-tcp
    connect)
  - Abort a two-phase-commit on peers when the target connection fails
    to prepare
  - Added max_parallel_resyncs module parameter to cap how many
    volumes may resync (or verify) in parallel
  - Fix multiple RDMA transport bugs hit during racing teardown: a
    NULL pointer dereference, a self-deadlock, and a cm object leak
  - Fix bogus resync speed/ETA reported in /proc/drbd when the
    out-of-sync amount grows
  - Do not throttle a resync that is losing ground to ongoing writes

9.3.2 (api:genl2/proto:86-101,118-124/transport:22)
--------
 * Use genl pre_doit/post_doit for netlink request setup and teardown
 * Handle recv returning 0 (EOF) in recv_bio
 * Revert flush_send_buffer send error causing state change
 * Fix a page leak in the RDMA transport's send-page path
 * All fixes from 9.2.18
  - Fix when a diskless primary creates a new current UUID,
    fixing possible silent data divergence later
  - Fix quorum calculation upon attach/detach operations
  - Handle split-brain recovery strategies during attach
    like they are handled during connect
  - Hanle attaching of large devices (~100TiB) without triggering
    the NMI watchdog
  - Fix a race condition in the RDMA code that could lead to
    leaking a cm object
  - Skip new-region resync for zero-guarantee backends at attach
  - drbdsetup attach waits for completion of disk state negotiation
    before returning
  - Fix missing disk line in drbdsetup show while in D_NEGOTIATING state
  - A few fixes found by the static analyzer smatch

9.3.1 (api:genl2/proto:86-101,118-124/transport:21)
--------
 * Use compound pages to optimize large I/O performance
 * New option for setting the discard granularity exposed on
   diskless nodes
 * Add per-peer_device tiebreaker config flag for quorum
 * Fix compat-8.4 /proc/drbd output for connected resources
 * Fix a race that could lead that a resyncs stalls when it
   should complete.
 * All fixes from 9.2.17
  - Fix a kernel crash triggered by a crafted/invalid netlink message
  - Fix a crash when resyncing with a peer supporting proto 121,
    e.g. drbd-9.1.23
  - Fixed two corner case regressions regarding bitmap lifetime
    (introduced with 9.2.16)
  - Add a static analyzer that checks for correctly handling bitmap
    object lifetime; it identified 6 bugs
  - Correctly request BLK_FEAT_STABLE_WRITES from the kernel; Kernels
    side changes lead to this queue flag not being active
  - Fix lb-tcp to not corrupt data when it reassembles a data chunk, it
    split for sending over multiple paths in parallel
  - Add a special case to ensure LINSTOR re-provisioned nodes with thin
    volumes get the necessary incremental resync
  - Always do a two-phase-commit for attach, closes a race that could
    lead to an inconsistent repl states
  - Skip unnecessary resync when a missed end-of-resync has 0 bits;
    before that fix, DRBD could end up in inconsistent repl states
  - Fix a case where a send error was ignored on congested connections
  - Make detection of missed end-of-resync symmetric; the bug led to
    inconsistent repl states
  - Make the RDMA transport compatible with RXE (software RoCE),
    and some mainly performance-related fixes

9.3.0 (api:genl2/proto:86-101,118-123/transport:19)
--------
 * was forked off between 9.2.12 and 9.2.13
 * Implemented resync without replication and made it the default; the
   previous (drbd-9.2 and earlier) behavior is still available via a
   config option. With that, the resync operation begins with
   mirroring of application writes disabled, and it performs multiple
   resync passes, clearing bits in the bitmap. It enables application
   write mirroring when the resync is nearly complete. That reduces
   the I/O load during resync, and in most cases, it reduces resync
   time.
 * Implemented support for bitmap granularity between 4k and 1M,
   including exchanging bitmaps with peers with a different bitmap
   block size
 * Give filesystems mounted on DRBD a chance to bring their on-disk
   representations into a consistent state before suspending I/O.
 * Add support for omitting bitmap allocation for standalone devices
 * Explicit config option for drbd8-api-compatibility mode
 * Dropped support for RHEL7 and support for kernels older than 3.10.
 * All fixes from 9.2.13 to 9.2.16
 * Compatibility with Linux-6.18