Re: fsync() errors is unsafe and risks data loss

[Jeff Layton <jlayton@redhat.com>]

On Thu, 2018-04-12 at 13:28 -0700, Matthew Wilcox wrote:
> On Thu, Apr 12, 2018 at 01:13:22PM -0700, Andres Freund wrote:
> > I think a per-file or even per-blockdev/fs error state that'd be
> > returned by fsync() would be more than sufficient.
>
> Ah; this was my suggestion to Jeff on IRC.  That we add a per-
> superblock
> wb_err and then allow syncfs() to return it.  So you'd open an fd on
> a directory (for example), and call syncfs() which would return -EIO
> or -ENOSPC if either of those conditions had occurred since you
> opened
> the fd.

Not a bad idea and shouldn't be too costly. mapping_set_error could
flag the superblock one before or after the one in the mapping.

We'd need to define what happens if you interleave fsync and syncfs
calls on the same inode though. How do we handle file->f_wb_err in that
case? Would we need a second field in struct file to act as the per-sb
error cursor?

> >  I don't see that
> > that'd realistically would trigger OOM or the inability to unmount
> > a
> > filesystem.
> 
> Ted's referring to the current state of affairs where the writeback
> error
> is held in the inode; if we can't evict the inode because it's
> holding
> the error indicator, that can send us OOM.  If instead we transfer
> the
> error indicator to the superblock, then there's no problem.
> 

-- 
Jeff Layton <jlayton@redhat.com>