From 193ef29f3f0886e3d59e6580e394f8817f2f123e Mon Sep 17 00:00:00 2001 From: Jonathan Lebon Date: Sat, 27 May 2023 10:37:30 -0400 Subject: [PATCH 5/5] lib/deploy: Use `fallocate` for early prune space check The `f_bfree` member of the `statvfs` struct is documented as the "number of free blocks". However, different filesystems have different interpretations of this. E.g. on XFS, this is truly the number of blocks free for allocating data. On ext4 however, it includes blocks that are actually reserved by the filesystem and cannot be used for file data. (Note this is separate from the distinction between `f_bfree` and `f_bavail` which isn't relevant to us here since we're privileged.) If a kernel and initrd is sized just right so that it's still within the `f_bfree` limit but above what we can actually allocate, the early prune code won't kick in since it'll think that there is enough space. So we end up hitting `ENOSPC` when we actually copy the files in. Rework the early prune code to instead use `fallocate` which guarantees us that a file of a certain size can fit on the filesystem. `fallocate` requires filesystem support, but all the filesystems we care about for the bootfs support it (including even FAT). (There's technically a TOCTOU race here that existed also with the `statvfs` code where free space could change between when we check and when we copy. Ideally we'd be able to pass down that fd to the copying bits, but anyway in practice the bootfs is pretty much owned by libostree and one doesn't expect concurrent writes during a finalization operation.) --- src/libostree/ostree-sysroot-deploy.c | 66 +++++++++++++++++++++------ 1 file changed, 51 insertions(+), 15 deletions(-) diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c index 450f593e..425abe8b 100644 --- a/src/libostree/ostree-sysroot-deploy.c +++ b/src/libostree/ostree-sysroot-deploy.c @@ -2441,6 +2441,30 @@ get_kernel_layout_size (OstreeSysroot *self, OstreeDeployment *deployment, guint return TRUE; } +/* This is a roundabout but more trustworthy way of doing a space check than + * relying on statvfs's f_bfree when you know the size of the objects. */ +static gboolean +dfd_fallocate_check (int dfd, __off_t len, gboolean *out_passed, GError **error) +{ + g_auto (GLnxTmpfile) tmpf = { + 0, + }; + if (!glnx_open_tmpfile_linkable_at (dfd, ".", O_WRONLY | O_CLOEXEC, &tmpf, error)) + return FALSE; + + *out_passed = TRUE; + /* There's glnx_try_fallocate, but not with the same error semantics. */ + if (TEMP_FAILURE_RETRY (fallocate (tmpf.fd, 0, 0, len)) < 0) + { + if (G_IN_SET (errno, ENOSYS, EOPNOTSUPP)) + return TRUE; + else if (errno != ENOSPC) + return glnx_throw_errno_prefix (error, "fallocate"); + *out_passed = FALSE; + } + return TRUE; +} + /* Analyze /boot and figure out if the new deployments won't fit in the * remaining space. If they won't, check if deleting the deployments that are * getting rotated out (e.g. the current rollback) would free up sufficient @@ -2553,16 +2577,17 @@ auto_early_prune_old_deployments (OstreeSysroot *self, GPtrArray *new_deployment net_new_bootcsum_dirs_total_size += bootdir_size; } - /* get bootfs free space */ - struct statvfs stvfsbuf; - if (TEMP_FAILURE_RETRY (fstatvfs (self->boot_fd, &stvfsbuf)) < 0) - return glnx_throw_errno_prefix (error, "fstatvfs(boot)"); - - guint64 available_size = stvfsbuf.f_bsize * stvfsbuf.f_bfree; - - /* does the bootfs have enough free space for net-new bootdirs? */ - if (net_new_bootcsum_dirs_total_size <= available_size) - return TRUE; /* nothing to do! */ + { + gboolean bootfs_has_space = FALSE; + if (!dfd_fallocate_check (self->boot_fd, net_new_bootcsum_dirs_total_size, &bootfs_has_space, + error)) + return glnx_prefix_error (error, "Checking if bootfs has space"); + + /* does the bootfs have enough free space for temporarily holding both the new + * and old bootdirs? */ + if (bootfs_has_space) + return TRUE; /* nothing to do! */ + } /* OK, we would fail if we tried to write the new bootdirs. Is it salvageable? * First, calculate how much space we could save with the bootcsums scheduled @@ -2574,12 +2599,23 @@ auto_early_prune_old_deployments (OstreeSysroot *self, GPtrArray *new_deployment bootcsum_dirs_to_remove_total_size += GPOINTER_TO_UINT (sizep); } - if (net_new_bootcsum_dirs_total_size > (available_size + bootcsum_dirs_to_remove_total_size)) + if (net_new_bootcsum_dirs_total_size > bootcsum_dirs_to_remove_total_size) { - /* Even if we auto-pruned, the new bootdirs wouldn't fit. Just let the - * code continue and let it hit ENOSPC. */ - g_printerr ("Disabling auto-prune optimization; insufficient space left in bootfs\n"); - return TRUE; + /* Check whether if we did early prune, we'd have enough space to write + * the new bootcsum dirs. */ + gboolean bootfs_has_space = FALSE; + if (!dfd_fallocate_check ( + self->boot_fd, net_new_bootcsum_dirs_total_size - bootcsum_dirs_to_remove_total_size, + &bootfs_has_space, error)) + return glnx_prefix_error (error, "Checking if bootfs has space"); + + if (!bootfs_has_space) + { + /* Even if we auto-pruned, the new bootdirs wouldn't fit. Just let the + * code continue and let it hit ENOSPC. */ + g_printerr ("Disabling auto-prune optimization; insufficient space left in bootfs\n"); + return TRUE; + } } g_printerr ("Insufficient space left in bootfs; updating bootloader in two steps\n"); -- 2.40.1