Do not resume a pool if multihost is enabled

When multihost is enabled, and a pool is suspended, return
EINVAL in response to "zpool clear <pool>".  The pool
may have been imported on another host while I/O was suspended.

Reviewed-by: loli10K <ezomori.nozomu@gmail.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Olaf Faaland <faaland1@llnl.gov>
Closes #6933
Closes #8460

diff --git a/cmd/ztest/ztest.c b/cmd/ztest/ztest.c
index adbf60c60ef17a8934b7d8085f7234b134c0f584..8cc6a6ff95bc326675dd2fcaf670efee2f0a6eb3 100644 (file)
--- a/cmd/ztest/ztest.c
+++ b/cmd/ztest/ztest.c
@@ -2763,6 +2763,13 @@ ztest_mmp_enable_disable(ztest_ds_t *zd, uint64_t id)
        if (zo->zo_mmp_test)
                return;
 
+       /*
+        * Since enabling MMP involves setting a property, it could not be done
+        * while the pool is suspended.
+        */
+       if (spa_suspended(spa))
+               return;
+
        spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
        mutex_enter(&spa->spa_props_lock);
 

diff --git a/man/man8/zpool.8 b/man/man8/zpool.8
index 52604c1391bd4840a1879eecd1734837d8778db3..42aef91f986f2914e4b0dbabb448fd65fa1fde15 100644 (file)
--- a/man/man8/zpool.8
+++ b/man/man8/zpool.8
@@ -1013,6 +1013,9 @@ Clears device errors in a pool.
 If no arguments are specified, all device errors within the pool are cleared.
 If one or more devices is specified, only those errors associated with the
 specified device or devices are cleared.
+If multihost is enabled, and the pool has been suspended, this will not
+resume I/O.  While the pool was suspended, it may have been imported on
+another host, and resuming I/O could result in pool damage.
 .It Xo
 .Nm
 .Cm create

diff --git a/module/zfs/zfs_ioctl.c b/module/zfs/zfs_ioctl.c
index f4aea57d445ba4df77f803e0cdb1cb082ee8a462..ab40ae18556f8f6c8837c048e106c64b2cc097c8 100644 (file)
--- a/module/zfs/zfs_ioctl.c
+++ b/module/zfs/zfs_ioctl.c
@@ -5251,6 +5251,13 @@ zfs_ioc_clear(zfs_cmd_t *zc)
        if (error != 0)
                return (error);
 
+       /*
+        * If multihost is enabled, resuming I/O is unsafe as another
+        * host may have imported the pool.
+        */
+       if (spa_multihost(spa) && spa_suspended(spa))
+               return (SET_ERROR(EINVAL));
+
        spa_vdev_state_enter(spa, SCL_NONE);
 
        if (zc->zc_guid == 0) {