[yjftsjthsd-h]

Neat:) I would never use btrfs myself[0], but very happy to see people exploring all variations of these ideas. The one thing that's starting to bug me though, as I read blog posts about installing nixos: why is the install process so imperative/non-declarative? Once the system is up, the whole thing fits in configuration.nix, but to get there we still have to use masses of shell commands. Is anyone working on bridging that last gap and supporting partitions, filesystems, and mounts (I think that's all that's left?) from nix itself?

[0] I lost 2 root filesystems to btrfs, probably because it couldn't handle space exhaustion. I'm paranoid now.

[rrix2]

I have a fork of `justdoit.nix' https://github.com/cleverca22/nix-tests/blob/master/kexec/ju... which generates installer images with an auto-partitioning script and stub "configuration.nix" embedded in it with basically just enough of a system to get nixops or morph to deploy to it. it's kind of a pain to get that working the first few times since you have to wait for an image to bake and then test it in QEMU, and then make changes for nvme, etc, but it's brought up three systems now.

[yjftsjthsd-h]

Thanks! I'll have to give it a spin:)

[nix23]

I loose every two years (when i test it again) a volume to btrfs, last time 2 month ago, with that simple "trick":

-Fill your rootpartionion as root with "dd if=/dev/urandom of=./blabla bs=3m"

-rm blabla && sync (we don't want to be unfair to such a fragile system)

-Reboot and end up with unbootable /

It's a mess, for a filesystem i would declare it as alpha stage.

[cmurf]

I can't reproduce this on a 5.17.5 kernel and loop device. So if you're able to trivially reproduce it, I'm guessing it's configuration specific. It's still a bug, but to find it means providing more detail about that configuration, including the kernel version.

Ideally reproduce it with mainline kernel or most recent stable. And post the details on the linux-btrfs list. They are responsive to bug reports.

If you depend on LTS kernels then it's, OK to also include in the report the problem happens with X kernel but not Y kernel. Upstream only backports a subset of fixes and features to stable. Maybe the fix was missed and should have gone to stable or maybe it was too hard to backports.

These are general rules for kernel development, it's not btrfs specific. You'll find XFS and i915 devs asking for testing with more recent kernels too.

But in any case, problems won't get fixed without a report on an appropriate list.

[nix23]

>So if you're able to trivially reproduce it,

Make a VM OpenSUSE or Fedora (tested just these two) fill it and see it not boot anymore...it is trivial.

[cmurf]

OK this is a very different scenario than what I thought you were talking about (a broken file system). If a file system is full such that writes aren't possible, boot can fail no matter the file system. This isn't a file system problem. It's a failure to manage space.

Most distros require a read-write /sysroot, and expect the ability to write to disk. If they can't write, various services will fail and that can prevent startup from proceeding further. But without any logs, we have no idea what you're actually experiencing.

You are saying it won't boot but that's not at all a case of a broken file system. It's an expected consequence of the file system being full. Since the examples were clear intent of making the file system completely full, it's a setup to prevent the file system from further writes.

Overwriting file systems are expected to run into this problem less, but aren't immune to it. If the data write requirement is new writes, rather than overwriting, it'll fail whether ext4, XFS or Btrfs. If the requirement involves overwriting, it's expected overwriting file systems will succeed where COW file systems simply can't. It might be a valid argument in favor of non-root users being disallowed to use the last 1-5% of free space on any file system.

[nix23]

>You are saying it won't boot but that's not at all a case of a broken file system

Please read my comment in full especially that point:

- rm blabla && sync

- reboot

[londons_explore]

All these "clever" filesystems can never guarantee not to run out of space for their own metadata. That's because even to delete a file they might need more space in the journal, or to un-copy-on-write some metadata.

The mistake however is that even though it isn't practical to make theoretical guarantees that the filesystem won't end up full and broken, it is very possible to make such a thing only happen in exceeding unlikely cases. One runaway dd isn't that...

[nix23]

>it is very possible to make such a thing only happen in exceeding unlikely cases. One runaway dd isn't that...

It's not dd, it's one process run by root who fills the filesystem with one big file. That's like the first thing i would test if it can destroy my filesystem.

It's really the filesystem responsibility, if it needs to reserve 30% so be it, if it need's more because i wrote billions of files so be it, (even if it says "sorry i told you i have 50GB free but because you wrote so many small files it's now just 45GB" after all they just can make a estimation) so be it. But it's the filesystem job to tell me how much ~free space that i have, and stop writing before it really/internally cant take anymore. And NOT to kill itself because i alloc 100% of it, there's is just no excuse. That's the filesystem's responsibility.

PS: The clever ZFS survives that "unlikely" test easily.

[KingMachiavelli]

Why can't they? For example, Btrfs reserves some storage for it's internal use which should be more than enough to update the journal to fix a full filesystem.

[londons_explore]

Calculating exactly how much you need to reserve for the worst case is a near-impossible task.

For example, say you try to delete a file, which is part of one of multiple identical snapshots, so deleting the file doesn't free up any space, but does require extra metadata to be written (since a new directory entry will be needed that shows the file is deleted in this snapshot only).

The same operation could be done for millions of files, eating up all the reserved space. End result: full disk and unusable filesystem, even for deletes.

The alternative is not to allow file deletes to use reserved space. But now when you have a full disk, some things become 'undeletable', since the only way to free space is to delete all copies of the file, but it isn't permitted to delete any one copy of the file since the intermediate state would use more disk space.

[cmurf]

What is supposed to happen is the metadata commit fails due to enospc before the super block update. Thus the current super points to the current value working tree roots, not the partial/failed tree roots.

Btrfs won't issue the writes for super block update until the device says the current metadata transaction is successfully on stable media.

It is possible the filesystem is completely consistent (can be mounted, btrfsck finds no error), and yet not bootable due to the interruption of updates. Software updates are one transaction in user space but not atomic unless expressly designed for it. From the fs point of view, a software update might be broken up into dozens of fs transactions.

It's also possible the device lies about writes being on stable media. If the fs writes some metadata, does flush/FUA, then super block write, and flash/FUA, the device should only write the super block after the prior write is on stable media. If it says the first flush succeeded but that write is still happening, and the super block write goes to stable media before all the metadata writes get to stable media and there's a crash or power failure, then you can in fact have a broken filesystem. The super points to tree roots that don't exist. This is definitely a device flaw not an fs flaw.

Btrfs super blocks contain 3 backup roots. So it's possible to revert to an older and hopefully correct metadata generation (seconds to a couple minutes ago). But this has limited recovery potential. It's also completely thwarted right now if you use any discard mount option on an SSD because discard will ask the device to garbage collect recently freed metadata blocks. So the backup root trees pointed to by the super may already be zeros when they're needed.

But any need for backup roots already means some kind of device (firmware) flaw.

[Fnoord]

A lot of consumer grade SSDs and flash (microSD, eMMC) don't like it when they are near full. That's why you should set a reserved space and quotas. Notice your dd trick requires root which ignores the reserved space. At some point, its PEBCAK.

[vladvasiliu]

> A lot of consumer grade SSDs and flash (microSD, eMMC) don't like it when they are near full

I've heard about this, but my understanding was that when this happens, performance becomes extremely poor. While that may be quite bad, it's still worlds apart from losing data.

There's also the fact that the user may have partitioned the drive in a such a way to prevent it from ever filling up. Even root can't fill the partition beyond its size. Here, you have to go out of your way to make sure the partition doesn't fill out, or else you have a bad time. Shit happens, so this does look like a FS bug to me, much more than PEBCAK.

[Fnoord]

> While that may be quite bad, it's still worlds apart from losing data.

Except if you keep overwriting a flash-based storage system, at some point that flash storage gets destroyed (wear level). You can absolutely achieve such by having a near full filesystem on flash. Mechanical harddrives or partitions don't suffer from this issue.

Perhaps the issue occurs more quickly on btrfs, that I don't know, but it could happen on any filesystem. On the other hand, you should have backups. Personally, I use ZFS on two of my machines, with snapshot feature.

[vladvasiliu]

> Except if you keep overwriting a flash-based storage system, at some point that flash storage gets destroyed (wear level). You can absolutely achieve such by having a near full filesystem on flash. Mechanical harddrives or partitions don't suffer from this issue.

Wearing out is yet a different thing. I've had this happen on an SD card. It would refuse to write anything new, although it reported being mostly free. But the stuff that was already on it was readable.

I've had SD cards that got full. They didn't lose any data, and once I'd moved the things off them, they became usable again.

Granted, this was with a digital camera, so using fat32 at the time, so no fancy FS.

[nix23]

>Shit happens, so this does look like a FS bug to me, much more than PEBCAK.

Exactly, a swimming-pool should never explode if you overfill it, however it's the users responsibility to turn the water off to prevent "data/water-loss"

That's why we made filesystems, preserve and organize data and tell the user/system when it cant take anymore.

[cmurf]

Without more information on the exact mount error and btrfsck --readonly output, it's a guessing game.

In the ordinary cases, btrfs full behavior is the same as other filesystems. It gets full, you can delete files. Keep in mind deleting files on any cow filesystem is a write that consumes free space before space is freed from the delete operation. There is reserve space for this. If you hit an edge case (which would be a bug) there's currently no known data eating bugs. But it's not always obvious to the user their data hasn't been eaten if the filesystem won't mount. As in, this is indistinguishable from data loss. Nevertheless it's a serious bug so if you have a reproducer it needs to be reported.

[nix23]

>In the ordinary cases, btrfs full behavior is the same as other filesystems.

Exactly that's NOT the case:

>>-Reboot and end up with unbootable /

You can test it for yourself, it "works" reliable since over more then 8 years.

[nix23]

Ah, so it's a special btrfs feature, as root you can kill your filesystem by simply writing a file to it. I wonder what function that serves.

But hey how about a quota behind the scenes?....you know like ZFS? AFS? ReFS?...you know so the filesystem tells the user "sorry cant take anymore" before it really cant take anymore? That would be some crazy enterprise level stuff....

You know, a Filesystem that immediately stops writing and instead cares more about the data that's already on the platter?

BTW: It was a DC-Harddisk

[Fnoord]

This can happen on any filesystem under the circumstances of it becoming full as root. You are misinformed if you believe such isn't the case.

"Can't boot" is also vague. I've had data loss with XFS in 2002 or so (didn't have backups), couldn't mount filesystem anymore. Thanks to help on IRC from devs I got almost all data back. I've been able to get recover data from a dying Deathstar, too. And then there's the RAID5 write hole (can be mitigated), and RAID5 issues on btrfs (which are well known). For all we know you were using RAID5 shrug. Anyway, did you file a bug report, did you contact the devs?

[nix23]

> This can happen on any filesystem under the circumstances of it becoming full as root. You are misinformed if you believe such isn't the case.

No true with ZFS and XFS, you are trying to defend a ill designed filesystem....in typical linux *fashion ;)

It's S#it but at least we "invented" it.

[mekster]

Why isn't btrfs declared abandoned and just let people move on?

Everytime I read about it, someone is losing data.

Thank god Ubuntu makes zfs very easy to use. No reason to even consider touching btrfs.

[curt15]

How does zfs handle that test?

[SkyMarshal]

In both ZFS and btrfs, at initial setup you can create an extra dataset/subvolume of 1-2GB or whatever and leave it unused. If you ever fill up root and run into problems freeing up space on root, you can unallocate that extra volume and add it to root to fix the problem.

[vladvasiliu]

I haven't tried that particular test, but I've had a ZFS drive filled to the brim. I just deleted a bunch of files and was back to normal. This was on a computer with a single pool, also used for booting. The system didn't even crash or anything.

[nix23]

dd says "no space left" and kills itself, "df" says 100% full, "zpool list" says 98% 80GB free...it's like black magic that ZFS knows to keep some space for itself ;)

And to other comments:

It was a DC-Harddisk, and NO, not even root should be capable destroying the filesystem by simply write to it, it's not 1970 anymore.

Calculating the "to reserve" Metadata-block should be rather trivial since it's ONE big file. And it's not dd that is the problem, it's btrfs that cannot handle a process that writes ONE BIG file.