From 2a95100f6399ace2fdf5eea4d5ebaf69591145bb Mon Sep 17 00:00:00 2001 From: Mike Freedman Date: Fri, 22 May 2026 15:56:05 -0400 Subject: [PATCH] fix(fuse): extend FUSE_INTERRUPT decoupling to write paths The previous two fixes (4c7b4c1, b5cf146) decoupled FSAdapter and OpsNode read paths from the kernel's per-request context to stop FUSE_INTERRUPT (typically from Go SIGURG goroutine preemption under GC pressure) from spuriously cancelling DB queries. The decision to exclude write paths was based on the assumption that partial writes would have real consistency implications -- but that assumption was wrong: every tigerfs write op is either a single auto-committed statement or a single transaction wrapping a few atomic statements (DeleteAndUpdate for POSIX rename-as-replace). There is no partial state to leak when we ignore a transient cancellation; the kernel's FUSE_INTERRUPT is "you may stop early if you want," not "abort, the syscall is dying." Symptoms previously observed in docker-FUSE stress (~10% rate per 1500-iter run, on top of the cache-bug rate fixed in b5cf146): * close-time EIO during create_file / edit_file (Flush -> WriteFile) * rename ENOENT during move_file / rename_file (internal lookup of source path inside renameSynthFile gets cancelled, propagates as ErrNotExist) * delete ENOENT during delete_file (similar, internal lookup of victim path gets cancelled) Fix: add ctx = decoupleFromRequestCancel(ctx) to FSAdapter's four write methods (WriteFile, Delete, Mkdir, Rename). Update the decoupleFromRequestCancel doc comment to reflect that it now applies to both read and write paths, with the atomicity reasoning. Tests: four new unit tests in adapter_ctx_test.go, symmetric to the existing read-path tests. All 9 decoupling tests pass. Validation: 15/15 clean across 37,500 docker-FUSE stress iterations (--iterations 2500 --validate-every 1 --large-files --many-files). --- internal/tigerfs/fuse/adapter.go | 14 +++- internal/tigerfs/fuse/adapter_ctx_test.go | 81 +++++++++++++++++++++++ 2 files changed, 92 insertions(+), 3 deletions(-) diff --git a/internal/tigerfs/fuse/adapter.go b/internal/tigerfs/fuse/adapter.go index ca7e5df..a891954 100644 --- a/internal/tigerfs/fuse/adapter.go +++ b/internal/tigerfs/fuse/adapter.go @@ -224,9 +224,13 @@ func (a *FSAdapter) EntriesToDirEntries(entries []tigerfs.Entry) []gofuse.DirEnt // which fails in-flight queries. We only lose the per-request // cancellation channel, which the bug shows we don't actually want. // -// Write paths intentionally do NOT use this -- partial writes have -// real consistency implications when interrupted, and the request-ctx -// cancellation surface is the right tool there. +// Applies to both read and write paths. Each tigerfs write op runs as a +// single auto-committed statement (or a single transaction wrapping a +// few atomic statements -- e.g., DeleteAndUpdate for POSIX rename-as- +// replace). Either the whole statement/transaction commits or none of +// it commits; there is no partial state to leak when we ignore the +// kernel's transient cancellation. The kernel's FUSE_INTERRUPT means +// "you may stop early if you want," not "abort, the syscall is dying." func decoupleFromRequestCancel(ctx context.Context) context.Context { return context.WithoutCancel(ctx) } @@ -305,6 +309,7 @@ func (a *FSAdapter) ReadFile(ctx context.Context, path string) ([]byte, syscall. // // Returns errno (0 on success). func (a *FSAdapter) WriteFile(ctx context.Context, path string, data []byte) syscall.Errno { + ctx = decoupleFromRequestCancel(ctx) fsErr := a.ops.WriteFile(ctx, path, data) return a.ErrorToErrno(fsErr) } @@ -319,6 +324,7 @@ func (a *FSAdapter) WriteFile(ctx context.Context, path string, data []byte) sys // // Returns errno (0 on success). func (a *FSAdapter) Delete(ctx context.Context, path string) syscall.Errno { + ctx = decoupleFromRequestCancel(ctx) fsErr := a.ops.Delete(ctx, path) return a.ErrorToErrno(fsErr) } @@ -334,6 +340,7 @@ func (a *FSAdapter) Delete(ctx context.Context, path string) syscall.Errno { // // Returns errno (0 on success). func (a *FSAdapter) Mkdir(ctx context.Context, path string) syscall.Errno { + ctx = decoupleFromRequestCancel(ctx) fsErr := a.ops.Mkdir(ctx, path) return a.ErrorToErrno(fsErr) } @@ -350,6 +357,7 @@ func (a *FSAdapter) Mkdir(ctx context.Context, path string) syscall.Errno { // // Returns errno (0 on success). func (a *FSAdapter) Rename(ctx context.Context, oldPath, newPath string) syscall.Errno { + ctx = decoupleFromRequestCancel(ctx) fsErr := a.ops.Rename(ctx, oldPath, newPath) return a.ErrorToErrno(fsErr) } diff --git a/internal/tigerfs/fuse/adapter_ctx_test.go b/internal/tigerfs/fuse/adapter_ctx_test.go index 2b4141d..8a7c151 100644 --- a/internal/tigerfs/fuse/adapter_ctx_test.go +++ b/internal/tigerfs/fuse/adapter_ctx_test.go @@ -88,6 +88,87 @@ func TestFSAdapter_ReadFile_DecouplesRequestCancel(t *testing.T) { } } +// Write-path coverage. Symmetric to the read-path tests: each FSAdapter +// write method must also decouple the request ctx so FUSE_INTERRUPT +// (typically from Go SIGURG goroutine preemption) doesn't surface as +// close-time EIO / rename ENOENT / delete ENOENT on otherwise valid ops. + +func TestFSAdapter_WriteFile_DecouplesRequestCancel(t *testing.T) { + capturedCtx := captureCtxViaWriteFile(t, "/public/anything") + if capturedCtx == nil { + t.Fatal("Operations was not reached; FSAdapter short-circuited (regression)") + } + if capturedCtx.Err() != nil { + t.Errorf("FSAdapter forwarded cancelled ctx to DB layer: %v", capturedCtx.Err()) + } +} + +func TestFSAdapter_Delete_DecouplesRequestCancel(t *testing.T) { + capturedCtx := captureCtxViaDelete(t, "/public/anything") + if capturedCtx == nil { + t.Fatal("Operations was not reached; FSAdapter short-circuited (regression)") + } + if capturedCtx.Err() != nil { + t.Errorf("FSAdapter forwarded cancelled ctx to DB layer: %v", capturedCtx.Err()) + } +} + +func TestFSAdapter_Mkdir_DecouplesRequestCancel(t *testing.T) { + capturedCtx := captureCtxViaMkdir(t, "/public/anything") + if capturedCtx == nil { + t.Fatal("Operations was not reached; FSAdapter short-circuited (regression)") + } + if capturedCtx.Err() != nil { + t.Errorf("FSAdapter forwarded cancelled ctx to DB layer: %v", capturedCtx.Err()) + } +} + +func TestFSAdapter_Rename_DecouplesRequestCancel(t *testing.T) { + capturedCtx := captureCtxViaRename(t, "/public/old", "/public/new") + if capturedCtx == nil { + t.Fatal("Operations was not reached; FSAdapter short-circuited (regression)") + } + if capturedCtx.Err() != nil { + t.Errorf("FSAdapter forwarded cancelled ctx to DB layer: %v", capturedCtx.Err()) + } +} + +func captureCtxViaWriteFile(t *testing.T, path string) context.Context { + t.Helper() + adapter, captured := newAdapterWithCtxCapture() + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _ = adapter.WriteFile(ctx, path, []byte("data")) + return *captured +} + +func captureCtxViaDelete(t *testing.T, path string) context.Context { + t.Helper() + adapter, captured := newAdapterWithCtxCapture() + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _ = adapter.Delete(ctx, path) + return *captured +} + +func captureCtxViaMkdir(t *testing.T, path string) context.Context { + t.Helper() + adapter, captured := newAdapterWithCtxCapture() + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _ = adapter.Mkdir(ctx, path) + return *captured +} + +func captureCtxViaRename(t *testing.T, oldPath, newPath string) context.Context { + t.Helper() + adapter, captured := newAdapterWithCtxCapture() + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _ = adapter.Rename(ctx, oldPath, newPath) + return *captured +} + // captureCtxViaReadDir constructs an FSAdapter wired to a MockDBClient // that records the ctx given to GetCurrentSchema (the earliest DB call // Operations.ReadDir makes), invokes ReadDir with an already-cancelled