Read corruption after O_TRUNC + file_copy_range (under high IO load) #18412

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <pthread.h>
#include <errno.h>

#define FILE_SIZE (1024 * 1024) // 1MB
#define RECORD_SIZE (128 * 1024) // 128KiB ZFS recordsize
#define NUM_THREADS 64

void *run_test(void *arg)
{
	int thread_id = (int)(long)arg;

	char src_path[64], dst_path[64];
	sprintf(src_path, "src-%d.bin", thread_id);
	sprintf(dst_path, "dst-%d.bin", thread_id);

	unsigned char *write_buf = malloc(FILE_SIZE);
	unsigned char *read_buf = malloc(FILE_SIZE);

	// Write out expected data.
	memset(write_buf, 0xAA, FILE_SIZE);
	int src = open(src_path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
	if (write(src, write_buf, FILE_SIZE) != FILE_SIZE)
		perror("write");
	close(src);

	// Create destination file so we exercise O_TRUNC.
	int dst = open(dst_path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
	if (write(dst, write_buf, FILE_SIZE) != FILE_SIZE)
		perror("write");
	fsync(dst);
	close(dst);

	// Open file with O_TRUNC and perform copy.
	src = open(src_path, O_RDONLY);
	dst = open(dst_path, O_WRONLY | O_CREAT | O_TRUNC, 0644);

	loff_t off_in = 0, off_out = 0;
	ssize_t ret =
		copy_file_range(src, &off_in, dst, &off_out, FILE_SIZE, 0);
	if (ret != FILE_SIZE)
		perror("copy_file_range");
	close(src);
	close(dst);

	// Read back
	dst = open(dst_path, O_RDONLY);
	if (read(dst, read_buf, FILE_SIZE) != FILE_SIZE)
		perror("read");
	close(dst);

	// Bug check
	if (memcmp(write_buf, read_buf, FILE_SIZE) != 0) {
		fprintf(stderr, "[%d]: FAIL\n", thread_id);

		int all_zeros = 1;
		for (int i = 0; i < RECORD_SIZE; i++) {
			if (read_buf[i] != 0) {
				all_zeros = 0;
				break;
			}
		}

		if (all_zeros) {
			fprintf(stderr, "[%d]: ALL ZERO\n", thread_id);
		}

		goto keep_file;
	}

	unlink(src_path);
	unlink(dst_path);
keep_file:
	free(write_buf);
	free(read_buf);
	return NULL;
}

int main()
{
	pthread_t threads[NUM_THREADS];

	for (int i = 0; i < NUM_THREADS; i++) {
		pthread_create(&threads[i], NULL, run_test, (void *)(long)i);
	}
	for (int i = 0; i < NUM_THREADS; i++) {
		pthread_join(threads[i], NULL);
	}

	return 0;
}