btrfs: stripe_alloc: gate data admission on claimable whole-stripe supply

Wire stripe_claimable into the DATA reservation path so write() returns -ENOSPC
when there is no fully-free whole stripe to place the write crash-safely --
matching statfs f_bavail, which already subtracts the trapped partial-stripe
space.  Add stripe_claimable_admit() and AND it into the two data-admit sites:
__reserve_bytes() and btrfs_try_granting_tickets() (the latter is required, or a
flushed data ticket would be granted by the plain used<=total rule, bypassing the
gate).  Scoped to raid56 stripe_alloc DATA (stripe_margin_unit != 0); metadata,
non-raid56 and zoned space_infos are unaffected.

The gate refuses at reservation time, before the range becomes delalloc and later
parks at writeback with nowhere to land -- so ENOSPC is clean and there is no
fill-edge parking collapse.

Phase 1 is pessimistic: it gates on bytes_stripe_claimable alone, which errs LOW,
so it can refuse a write that would have landed in a partially-open stripe
(over-refuses by the open remainder, healed by the commit rescan raising claimable
and the FLUSH_DATA ticket retry).  A later change adds bytes_stripe_open to the
bound for statfs-exact behavior.

Assisted-by: Claude:claude-opus-4-8

diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 74a1fc7906b9b1a5f09853251aacde40a9751bf0..66f652f0bbc75084c04c7eb55c74d31970177dff 100644 (file)
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -649,6 +649,35 @@ static void remove_ticket(struct btrfs_space_info *space_info,
        spin_unlock(&ticket->lock);
 }
 
+/*
+ * stripe_alloc DATA admission gate.  On a raid56 stripe_alloc DATA space_info a
+ * write can only be placed crash-safely in a fully-free whole stripe, so admit a
+ * data reservation only while the whole-stripe supply (bytes_stripe_claimable,
+ * which errs LOW now that the incremental positive credit is gone) covers all
+ * outstanding reservations plus this one.  This refuses at reservation time --
+ * before the range becomes delalloc and later parks at writeback with nowhere to
+ * land -- and makes write() -ENOSPC coincide with statfs f_bavail==0 (both on the
+ * whole-stripe bound).  Non-stripe_alloc / metadata / non-raid56 space_infos are
+ * unaffected: stripe_margin_unit is 0 unless a raid56 DATA bg exists.  Caller
+ * holds space_info->lock.
+ *
+ * Phase 1 is deliberately PESSIMISTIC: it gates on claimable alone, so it can
+ * refuse a write that would have landed in a partially-open stripe (over-refuses
+ * by the open remainder, healed by the commit rescan raising claimable + the
+ * FLUSH_DATA ticket retry).  A later phase adds bytes_stripe_open to the bound to
+ * match statfs exactly and recover that space.
+ */
+static bool stripe_claimable_admit(struct btrfs_space_info *space_info, u64 bytes)
+{
+       struct btrfs_fs_info *fs_info = space_info->fs_info;
+
+       if (!btrfs_test_opt(fs_info, STRIPE_ALLOC) ||
+           !(space_info->flags & BTRFS_BLOCK_GROUP_DATA) ||
+           !READ_ONCE(fs_info->stripe_margin_unit))
+               return true;
+       return space_info->bytes_may_use + bytes <= space_info->bytes_stripe_claimable;
+}
+
 /*
  * This is for space we already have accounted in space_info->bytes_may_use, so
  * basically when we're returning space from block_rsv's.
@@ -671,8 +700,9 @@ again:
                used_after = used + ticket->bytes;
 
                /* Check and see if our ticket can be satisfied now. */
-               if (used_after <= space_info->total_bytes ||
-                   can_overcommit(space_info, used, ticket->bytes, flush)) {
+               if ((used_after <= space_info->total_bytes ||
+                    can_overcommit(space_info, used, ticket->bytes, flush)) &&
+                   stripe_claimable_admit(space_info, ticket->bytes)) {
                        btrfs_space_info_update_bytes_may_use(space_info, ticket->bytes);
                        remove_ticket(space_info, ticket, 0);
                        space_info->tickets_id++;
@@ -1905,7 +1935,8 @@ static int reserve_bytes(struct btrfs_space_info *space_info, u64 orig_bytes,
         */
        if (!pending_tickets &&
            ((used + orig_bytes <= space_info->total_bytes) ||
-            can_overcommit(space_info, used, orig_bytes, flush))) {
+            can_overcommit(space_info, used, orig_bytes, flush)) &&
+           stripe_claimable_admit(space_info, orig_bytes)) {
                btrfs_space_info_update_bytes_may_use(space_info, orig_bytes);
                ret = 0;
        }