Skip to content

fix(fault): log dm-flakey guard cleanup failures instead of discarding#24

Merged
overtrue merged 1 commit into
mainfrom
fix/host-backend-logged-drop
Jul 15, 2026
Merged

fix(fault): log dm-flakey guard cleanup failures instead of discarding#24
overtrue merged 1 commit into
mainfrom
fix/host-backend-logged-drop

Conversation

@overtrue

Copy link
Copy Markdown
Contributor

Summary

DmFlakeyGuard::drop discarded both cleanup steps with let _ =:

if !recovery_table.is_empty() {
    let _ = self.load_table(&recovery_table, true); // restores healthy table on a REAL block device
}
let _ = self.delete_helper();                       // deletes the privileged helper pod

A silently-dropped restore leaves the injected fault table live on a real block device on the target node; a dropped delete leaks the privileged (hostPID + host-root-mounted) helper pod. Both are exactly the leak class #16 hardened — it added the logged-cleanup pattern to ChaosGuard::drop for chaos CRs, but the host/device-mapper backend (the most dangerous one, since it mutates a real block device) never received it.

This surfaces both failures via eprintln! with node/target/pod context, matching ChaosGuard::drop verbatim in style. Behaviour is otherwise unchanged — a successful cleanup path is identical; only the previously-swallowed error cases now emit an operator-visible warning.

Validation

  • cargo fmt --all clean
  • cargo clippy --all-targets clean
  • cargo test — 236 + 15 pass, 0 failures

Follow-up to #16; part of the s3chaos review tracked in rustfs/backlog#1100.

Copilot AI review requested due to automatic review settings July 10, 2026 06:29

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

DmFlakeyGuard::drop discarded both the recovery-table restore and the
helper-pod delete with `let _ =`. A silently-dropped restore leaves the
injected fault table live on a real block device; a dropped delete leaks
the privileged helper pod. PR #16 established this logged-cleanup pattern
for ChaosGuard (chaos CRs) but the more dangerous host backend never got
it. Surface both failures via eprintln with node/target/pod context so the
leak is visible to operators, matching ChaosGuard::drop.
@overtrue
overtrue force-pushed the fix/host-backend-logged-drop branch from c511de7 to 2669a6a Compare July 12, 2026 02:15
@overtrue
overtrue added this pull request to the merge queue Jul 15, 2026
Merged via the queue into main with commit 2920b99 Jul 15, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants