Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <a9d586a8c520e52bad2396b93f8d5cb8a9fd2071.camel@redhat.com>
Subject: Re: POSIX violation by writeback error
From:   Jeff Layton <jlayton@redhat.com>
To:     "J. Bruce Fields" <bfields@fieldses.org>,
        Rogier Wolff <R.E.Wolff@BitWizard.nl>
Cc:     =?UTF-8?Q?=E7=84=A6=E6=99=93=E5=86=AC?= <milestonejxd@gmail.com>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Date:   Tue, 04 Sep 2018 16:18:18 -0400
In-Reply-To: <20180904185411.GA22166@fieldses.org>
References: <CAJDTihz-rFb2SGaxZsQnXGnee_2qW_ynhPe=tZ4yzQBSV_KQ1g@mail.gmail.com>
         <20180904075347.GH11854@BitWizard.nl>
         <CAJDTihzqn3whQ47uUOxGYk4Je4S10ehNEQCtfb=j--iCsdDqgQ@mail.gmail.com>
         <82ffc434137c2ca47a8edefbe7007f5cbecd1cca.camel@redhat.com>
         <CAJDTihw7T8WLme09W8VHCRfiALq4fxg1ZsywcSjn6hXsAw5wRw@mail.gmail.com>
         <cd137e88c9e882200c08c7336aa7b5a1c84a7ba3.camel@redhat.com>
         <20180904161203.GD17478@fieldses.org> <20180904162348.GN17123@BitWizard.nl>
         <20180904185411.GA22166@fieldses.org>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, 2018-09-04 at 14:54 -0400, J. Bruce Fields wrote:
> On Tue, Sep 04, 2018 at 06:23:48PM +0200, Rogier Wolff wrote:
> > On Tue, Sep 04, 2018 at 12:12:03PM -0400, J. Bruce Fields wrote:
> > > Well, I think the point was that in the above examples you'd prefer that
> > > the read just fail--no need to keep the data.  A bit marking the file
> > > (or even the entire filesystem) unreadable would satisfy posix, I guess.
> > > Whether that's practical, I don't know.
> > 
> > When you would do it like that (mark the whole filesystem as "in
> > error") things go from bad to worse even faster. The Linux kernel 
> > tries to keep the system up even in the face of errors. 
> > 
> > With that suggestion, having one application run into a writeback
> > error would effectively crash the whole system because the filesystem
> > may be the root filesystem and stuff like "sshd" that you need to
> > diagnose the problem needs to be read from the disk.... 
> 
> Well, the absolutist position on posix compliance here would be that a
> crash is still preferable to returning the wrong data.  And for the
> cases 焦晓冬 gives, that sounds right?  Maybe it's the wrong balance in
> general, I don't know.  And we do already have filesystems with
> panic-on-error options, so if they aren't used maybe then maybe users
> have already voted against that level of strictness.
> 

Yeah, idk. The problem here is that this is squarely in the domain of
implementation defined behavior. I do think that the current "policy"
(if you call it that) of what to do after a wb error is weird and wrong.
What we probably ought to do is start considering how we'd like it to
behave.

How about something like this?

Mark the pages as "uncleanable" after a writeback error. We'll satisfy
reads from the cached data until someone calls fsync, at which point
we'd return the error and invalidate the uncleanable pages.

If no one calls fsync and scrapes the error, we'll hold on to it for as
long as we can (or up to some predefined limit) and then after that
we'll invalidate the uncleanable pages and start returning errors on
reads. If someone eventually calls fsync afterward, we can return to
normal operation.

As always though...what about mmap? Would we need to SIGBUS at the point
where we'd start returning errors on read()?

Would that approximate the current behavior enough and make sense?
Implementing it all sounds non-trivial though...

-- 
Jeff Layton <jlayton@redhat.com>