fix: strict filesystem unmount before kexec - #188
Closed
GeertJohan wants to merge 1 commit into
Closed
Conversation
Unmount failures during the post-installation teardown were tolerated
(logged and ignored) and the unmounts used MNT_FORCE. Both are wrong:
- per umount(2), MNT_FORCE only asks network filesystems (nfs, cifs,
fuse, 9p, ceph, lustre) to abort in-flight requests, 'could cause
data loss', and is a no-op on local filesystems - it cannot overcome
EBUSY.
- the machine kexecs right after the teardown, and kexec does not flush
the page cache ('reboot doesn't sync: do that yourself before calling
this', kernel/reboot.c). A tolerated unmount failure therefore
silently loses the latest writes. Observed in the field (v0.14.1 era,
Supermicro H13SRD-F): installed machines booting with the OS image's
placeholder /etc/fstab - the real fstab is written moments before the
teardown - leaving a read-only root and the filesystemlayout's extra
mounts (e.g. /var/lib) unmounted, which broke FRR on firewalls.
A successful unmount flushes all dirty pages and marks the filesystem
clean by itself, so exactly two outcomes are sound: unmounted (and
therefore durable), or a failed installation that is reported and
retried. Prior art: Ignition's umount stage also treats unmount failure
as fatal; Talos and coreos-installer unmount without MNT_FORCE.
Generated-By: Claude Code Fable 5
|
superseeded #190 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unmount failures during the post-installation teardown were tolerated (logged and ignored) and the unmounts used MNT_FORCE. Both are wrong:
A successful unmount flushes all dirty pages and marks the filesystem clean by itself, so exactly two outcomes are sound: unmounted (and therefore durable), or a failed installation that is reported and retried. Prior art: Ignition's umount stage also treats unmount failure as fatal; Talos and coreos-installer unmount without MNT_FORCE.
fixes #186
Used AI-Tools ✨
Claude Code Fable 5 was used to identify the issue and test fixes. Code has been reviewed line-by-line by myself.