fix: prevent data loss in raid failsafe transition and import#2181
Open
mrv777 wants to merge 2 commits into
Open
fix: prevent data loss in raid failsafe transition and import#2181mrv777 wants to merge 2 commits into
mrv777 wants to merge 2 commits into
Conversation
- raid: don't rename pools if the final zfs sync fails. otherwise we promote the migration pool without the last delta and then destroy the original copy. - raid: bail out of completeFailsafeTransition if the new main pool isn't there, so we don't wipe the previous pool. - migration: resume the import move if we were killed mid-move so the imported data doesn't get orphaned in the temp dir.
if the final sync fails we leave the @migration-final snapshot behind. destroy any stale one before recreating so retries are clean and we don't rely on errexit being suppressed in this function.
mrv777
marked this pull request as ready for review
June 30, 2026 17:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found these while reviewing the storage code. All three can lose user data.
raid failsafe transition (boot script)
The final
zfs send | zfs receivebefore the pool rename had no error check, and the function runs under|| truesoset -edoesn't catch it. If that sync failed, we'd rename the migration pool into place anyway (missing the last delta) and umbreld would then destroy the original pool. Now we only rename if the sync succeeded, otherwise we bail and boot back into the original pool.raid completeFailsafeTransition
It destroyed the previous (backup) pool after only checking that the previous pool existed, never that the new main pool actually came up. Added a check to bail if the main pool isn't there.
data import migration
activateImportedDataDirectorymovesimport-> temp -> data dir in two steps, guarded only byimportexisting. If we got killed between the moves, the imported data was orphaned in the temp dir forever and we'd boot with the un-imported data. Now it resumes the second move if the temp dir is there.Tested: typecheck passes, boot script passes
bash -n. The raid transition path needs a VM to test properly, not done here.