7 ms·

btrfs has made some headlines in the past about its severely broken checksum computation in RAID modes, which rules them out for production use, i.e. https://ph

by ge0rg 6y ago

btrfs has made some headlines in the past about its severely broken checksum computation in RAID modes, which rules them out for production use, i.e. https://phoronix.com/scan.php?page=news_item&px=Btrfs-RAID-56-Is-Bad https://phoronix.com/scan.php?page=news_item&px=Btrfs-RAID-5... The wrong parity and unrecoverable errors has been confirmed by multiple parties. The Btrfs RAID 5/6 code has been called as much as fatally flawed It would be interesting to know if this has been addressed already. The big fat red warning on btrfs' own wiki page is not inspiring trust either: https://btrfs.wiki.kernel.org/index.php/RAID56 https://btrfs.wiki.kernel.org/index.php/RAID56 For data, it should be safe as long as a scrub is run immediately after any unclean shutdown

greatgib 6y ago
I don't understand why you were downvoted. That is huge and I did not see this detailed in the original article and not even heard about it before.
- nix23 6y ago
  Fanboys...there was even a time when peoples defended Windows for being the best server-OS, and no one needs check-summing in the FS because HW-raid is the "professional" way.
jorritposthuma 6y ago
It's interesting to see how Synology "solves" this problem: https://www.synology.com/en-global/knowledgebase/DSM/tutorial/Storage/What_was_the_RAID_implementation_for_Btrfs_File_System_on_SynologyNAS https://www.synology.com/en-global/knowledgebase/DSM/tutoria...
- deleted 6y ago
  [deleted]
- berkut 6y ago
  Exactly the same way ReadyNAS solves it...
  - josteink 6y ago
    I observed that on my ReadyNAS too and always thought it was a weird setup. Now I know there are proper reasons for it. Good to know.
- nix23 6y ago
  I really don't trust Synology anymore, had so many destroyed Raid's in the past mainly with RS407. I buy a old Workstation slap FreeBSD with ZFS (RaidZ1 or 2) on it, and i am much happier.
- tobias3 6y ago
  Synology has solved it by running btrfs on top of mdraid, then patching it so that btrfs reports errors to mdraid and putting repair code into mdraid. This reliably works. I'm sure some would be interested in this, but Synology seems to not take GPLv2 too seriously and nobody seems to care about this. RAID 5/6 in btrfs is relatively neglected because the big users that pay developers to work on btrfs (and put the work up-stream) don't care that much about it. E.g. Facebook is probably using it for their HDFS storage, so HDFS gives them the RAID functionality.
  - throwaway8941 6y ago
    They use it for everything except MySQL databases, which are stored on XFS. There was a recent discussion on LKML where Chris Mason (I think) described all this.
    - petre 6y ago
      Does XFS have better performance than ext4 for MySQL DBs?
ibotty 6y ago
There are some modes that are horribly broken in btrfs (e.g. most of RAID except RAID1), but the common options are safe and in continuous use.
- nix23 6y ago
  >but the common options are safe and in continuous use Which would be Raid5/6 and 1
- ansible 6y ago
  We've recently suffered a catastrophic failure with btrfs RAID-1 on two fileservers recently. They were both RAID-1 with two 4TB drives, stock Ubuntu 16.04. With one of the two, the filesystem was allowed to fill to 99% capacity (no automatic monitoring), so obviously that is operator error, and I'm not aware of any filesystem that can handle such situations gracefully. The system became unresponsive, with btrfs-transaction taking up an increasing percentage of CPU time. Removing files and snapshots did not see an increase in free space. So what is super-curious is that the other server, which only ever got up to about 30% full, also started exhibiting the same symptoms: unresponsive, high load from btrfs-transaction. I was able to mount the filesystems in read-only mode, and recover the files, and checked it against the offsite backup. So no data loss, only a service loss. Both systems had 10 or so subvolumes, and read-only snapshots were taken three times per day for each subvolume. After 4 years, that's close to 15000 snapshots, maybe more. I searched around, but didn't find anything particularly relevant to this issue.
  - eptcyka 6y ago
    I suffered a similar breakdown with no raid. But this was about 5 years ago. The filesystem filled up, had plenty of snapshots, but removing snapshots did not actually clean up any space. Had this happen twice. So I don't think this is related to RAID. Just regular old butter filesystem. On a slightly unrelated note, I once suffered a complete failure of BTRFS where after a shutdown it just wouldn't mount anything again. Interestingly, on IRC, I was told that his is because the firmware on my Samsung NVME SSD was buggy. It might be, but ext4 has not failed me once in that regard.
baaym 6y ago
I configured BTRFS for my data a couple of years ago on my Debian machine. It's using RAID10 - and the RAID 5/6 issue was widely known back then so I did not dare to touch that. I must say that (fingers crossed) until now I haven't had any issues with it. There have been a couple of unclean shutdowns that haven't led to any corruptions. Scrub runs every couple of weeks and on top of that the data has an offline (external disk) and off-site (rsync.net through borgbackup) backup. I'm not expecting BTRFS to let me down, but if it does I have recovery options. I tend to be very careful with my 17+ years of photo archives, especially since I'm generating hundreds of megabytes of new content every week since my daughter was born. It definitely doesn't look good that RAID 5/6 is broken, but I feel very safe using the other stable RAID modes. Sometimes I'm dreaming of setting up ZFS - however the downside of that is that it doesn't live in the kernel and you're forced to work with kernel modules. It's certainly doable, but since I had a kernel module issue with Wireguard a few months ago I'll be "looking the cat out of the tree" for a bit more before I decide if I actually want to make the move. For now BTRFS feels stable for me, so until that changes - or the benefits of ZFS increase by a fair amount - I'll probably stay on this.
cmurf 6y ago
Raid 5/6 isn't exactly relevant to this article, given its about laptop/desktop default file system. And the installer won't let you do raid5/6. Anyway a current write-up on btrfs raid 5 here: https://lore.kernel.org/linux-btrfs/20200627032414.GX10769@hungrycats.org/ https://lore.kernel.org/linux-btrfs/20200627032414.GX10769@h... Includes this observation: "btrfs raid5 is quantitatively more robust against data corruption than ext4+mdadm (which cannot self-repair corruption at all), but not as reliable as btrfs raid1 (which can self-repair all single-disk corruptions detectable by csum check)." But worth reading the whole thing.
jiggawatts 6y ago
I'm reading through the links, and at first I thought this was a historical problem that was last reported in 2016/2017, but then gems like this from mid 2020 are popping up: "When 'btrfs scrub' is used for a raid5 array, it still runs a thread for each disk, but each thread reads data blocks from all disks in order to compute parity. This is a performance disaster, as every disk is read and written competitively by each thread" I have no words. Why would anyone ever think that this is a good idea? Who sat down at their computer and typed the code that does this!? How was this never tested? You know what, thinking about it, I do actually have some rather choice words to describe the situation: This boggles the mind to a level that requires further explanation, because the casual observer would likely fail to grasp the enormity of the failure that has occurred here. This isn't like, "oops, I forgot to up-shift gears in my car when going on the onramp", this is more like "the pilot forgot about the flaps after takeoff and the plane ran out of fuel.". There's a fundamental difference in the expectation of quality between, say, a random command line utility and a RAID filesystem. To give some context: BTRFS was developed largely concurrent with, and in direct competition to Sun's ZFS. Unlike all previous SAN arrays, RAID cards, and filesystems, ZFS was explicitly designed for reliability. Sun famously had a 'test rig' where they abused each new build to death. Physically pulling disks. Randomly corrupting blocks. Running multiple operation types in parallel, while pulling disks. That kind of thing. When I read ZFS whitepapers, I was amazed at how many fundamental flaws in RAID integrity protection they discovered, and then solved. Rigorously. Meanwhile, BTRFS literally says, in 2020: Don't trust is, especially not for metadata, or data, or while scrubbing, which you had better baby-sit, otherwise say goodbye to your production environment! More fun quotes: - plan for the filesystem to be unusable during recovery. - be prepared to reboot multiple times during disk replacement. - btrfs raid5 does not provide as complete protection against on-disk data corruption as btrfs raid1 does. - scrub and dev stats report data corruption on wrong devices in raid5. - scrub sometimes counts a csum error as a read error instead on raid5. - errors during readahead operations are repaired without incrementing dev stats, discarding critical failure information. This is not just a raid5 bug, it affects all btrfs profiles. You'd have to be nuts to use BTRFS for RAID 5 or 6, and I would question its use for any form of RAID. PS: To the people downvoting this, please explain how you like people to be uninformed about catastrophic data corruption going ignored for 4 years below in the comments.
deleted 6y ago
[deleted]
petre 6y ago
Synology and SuSE are using it in production. I've been avoiding it even though we use openSuSE and it selects btrfs by default.
- cjbconnor 6y ago
  Synology uses a combination of btrfs and md to avoid btrfs's flaws
ansible 6y ago
> For data, it should be safe as long as a scrub is run immediately after any unclean shutdown Note that btrfs-scrub (according to the docs) is looking for on-disk block errors, comparing the data to the CRC (or whatever algo) to see if that matches. If it can recover the original data, the bad block is re-written with the correct CRC. So btrfs-scrub does not find or fix any errors with the filesystem structure. For that you need to run btrfs-check, and that can only be done offline.
- 8fingerlouie 6y ago
  > For that you need to run btrfs-check, and that can only be done offline. You almost never want to run btrfs-check. In itself, Btrfs is fairly "self healing", and only if you run into "weird things" in the log like invalid index files should you run check, and almost certainly never with the --repair option. The thing about Btrfs (and ZFS) is that it is Copy-on-Write, and as such, new data is written to an unused part of the filesystem. It doesn't need to modify structures of existing data, thereby reducing the risk of bad metadata. A file in Btrfs is either written or it is not. If a power outage occurs after a file has been written, but before the metadata is updated, the file is not written, and in case you're updating a file, the old file is still preserved. If a crash occurs while writing metadata, Btrfs has multiple copies of metadata, and is able to repair itself online.
- chasil 6y ago
  The latest mkfs.btrfs on my Oracle Linux 7 supports "crc32c, xxhash, sha256 or blake2." The relative benefits are discussed in "man 5 btrfs" in the "CHECKSUM ALGORITHM" section. man 5 btrfs | col -b | sed -n '/^CHECKSUM/,/^FILESYSTEM/p'
- wtallis 6y ago
  The reasoning for running a scrub after an unclean shutdown is not to catch corruption of the filesystem structure, but to catch data corruption resulting from the RAID5 write hole. If you're not using RAID5 or RAID6 for metadata, the write hole won't affect the filesystem structure and there shouldn't be any issues for btrfs-check to find.
- cmurf 6y ago

by ge0rg 6y ago

greatgib 6y ago

I don't understand why you were downvoted. That is huge and I did not see this detailed in the original article and not even heard about it before.

nix23 6y ago
Fanboys...there was even a time when peoples defended Windows for being the best server-OS, and no one needs check-summing in the FS because HW-raid is the "professional" way.

jorritposthuma 6y ago

It's interesting to see how Synology "solves" this problem: https://www.synology.com/en-global/knowledgebase/DSM/tutorial/Storage/What_was_the_RAID_implementation_for_Btrfs_File_System_on_SynologyNAS https://www.synology.com/en-global/knowledgebase/DSM/tutoria...

deleted 6y ago
[deleted]
berkut 6y ago
Exactly the same way ReadyNAS solves it...
- josteink 6y ago
  I observed that on my ReadyNAS too and always thought it was a weird setup. Now I know there are proper reasons for it. Good to know.
nix23 6y ago
I really don't trust Synology anymore, had so many destroyed Raid's in the past mainly with RS407. I buy a old Workstation slap FreeBSD with ZFS (RaidZ1 or 2) on it, and i am much happier.
tobias3 6y ago
Synology has solved it by running btrfs on top of mdraid, then patching it so that btrfs reports errors to mdraid and putting repair code into mdraid. This reliably works. I'm sure some would be interested in this, but Synology seems to not take GPLv2 too seriously and nobody seems to care about this. RAID 5/6 in btrfs is relatively neglected because the big users that pay developers to work on btrfs (and put the work up-stream) don't care that much about it. E.g. Facebook is probably using it for their HDFS storage, so HDFS gives them the RAID functionality.
- throwaway8941 6y ago
  They use it for everything except MySQL databases, which are stored on XFS. There was a recent discussion on LKML where Chris Mason (I think) described all this.
  - petre 6y ago
    Does XFS have better performance than ext4 for MySQL DBs?

ibotty 6y ago

There are some modes that are horribly broken in btrfs (e.g. most of RAID except RAID1), but the common options are safe and in continuous use.

nix23 6y ago
>but the common options are safe and in continuous use Which would be Raid5/6 and 1
ansible 6y ago
We've recently suffered a catastrophic failure with btrfs RAID-1 on two fileservers recently. They were both RAID-1 with two 4TB drives, stock Ubuntu 16.04. With one of the two, the filesystem was allowed to fill to 99% capacity (no automatic monitoring), so obviously that is operator error, and I'm not aware of any filesystem that can handle such situations gracefully. The system became unresponsive, with btrfs-transaction taking up an increasing percentage of CPU time. Removing files and snapshots did not see an increase in free space. So what is super-curious is that the other server, which only ever got up to about 30% full, also started exhibiting the same symptoms: unresponsive, high load from btrfs-transaction. I was able to mount the filesystems in read-only mode, and recover the files, and checked it against the offsite backup. So no data loss, only a service loss. Both systems had 10 or so subvolumes, and read-only snapshots were taken three times per day for each subvolume. After 4 years, that's close to 15000 snapshots, maybe more. I searched around, but didn't find anything particularly relevant to this issue.
- eptcyka 6y ago
  I suffered a similar breakdown with no raid. But this was about 5 years ago. The filesystem filled up, had plenty of snapshots, but removing snapshots did not actually clean up any space. Had this happen twice. So I don't think this is related to RAID. Just regular old butter filesystem. On a slightly unrelated note, I once suffered a complete failure of BTRFS where after a shutdown it just wouldn't mount anything again. Interestingly, on IRC, I was told that his is because the firmware on my Samsung NVME SSD was buggy. It might be, but ext4 has not failed me once in that regard.

baaym 6y ago

I configured BTRFS for my data a couple of years ago on my Debian machine. It's using RAID10 - and the RAID 5/6 issue was widely known back then so I did not dare to touch that. I must say that (fingers crossed) until now I haven't had any issues with it. There have been a couple of unclean shutdowns that haven't led to any corruptions. Scrub runs every couple of weeks and on top of that the data has an offline (external disk) and off-site (rsync.net through borgbackup) backup. I'm not expecting BTRFS to let me down, but if it does I have recovery options. I tend to be very careful with my 17+ years of photo archives, especially since I'm generating hundreds of megabytes of new content every week since my daughter was born. It definitely doesn't look good that RAID 5/6 is broken, but I feel very safe using the other stable RAID modes. Sometimes I'm dreaming of setting up ZFS - however the downside of that is that it doesn't live in the kernel and you're forced to work with kernel modules. It's certainly doable, but since I had a kernel module issue with Wireguard a few months ago I'll be "looking the cat out of the tree" for a bit more before I decide if I actually want to make the move. For now BTRFS feels stable for me, so until that changes - or the benefits of ZFS increase by a fair amount - I'll probably stay on this.

cmurf 6y ago

Raid 5/6 isn't exactly relevant to this article, given its about laptop/desktop default file system. And the installer won't let you do raid5/6. Anyway a current write-up on btrfs raid 5 here: https://lore.kernel.org/linux-btrfs/20200627032414.GX10769@hungrycats.org/ https://lore.kernel.org/linux-btrfs/20200627032414.GX10769@h... Includes this observation: "btrfs raid5 is quantitatively more robust against data corruption than ext4+mdadm (which cannot self-repair corruption at all), but not as reliable as btrfs raid1 (which can self-repair all single-disk corruptions detectable by csum check)." But worth reading the whole thing.

jiggawatts 6y ago

I'm reading through the links, and at first I thought this was a historical problem that was last reported in 2016/2017, but then gems like this from mid 2020 are popping up: "When 'btrfs scrub' is used for a raid5 array, it still runs a thread for each disk, but each thread reads data blocks from all disks in order to compute parity. This is a performance disaster, as every disk is read and written competitively by each thread" I have no words. Why would anyone ever think that this is a good idea? Who sat down at their computer and typed the code that does this!? How was this never tested? You know what, thinking about it, I do actually have some rather choice words to describe the situation: This boggles the mind to a level that requires further explanation, because the casual observer would likely fail to grasp the enormity of the failure that has occurred here. This isn't like, "oops, I forgot to up-shift gears in my car when going on the onramp", this is more like "the pilot forgot about the flaps after takeoff and the plane ran out of fuel.". There's a fundamental difference in the expectation of quality between, say, a random command line utility and a RAID filesystem. To give some context: BTRFS was developed largely concurrent with, and in direct competition to Sun's ZFS. Unlike all previous SAN arrays, RAID cards, and filesystems, ZFS was explicitly designed for reliability. Sun famously had a 'test rig' where they abused each new build to death. Physically pulling disks. Randomly corrupting blocks. Running multiple operation types in parallel, while pulling disks. That kind of thing. When I read ZFS whitepapers, I was amazed at how many fundamental flaws in RAID integrity protection they discovered, and then solved. Rigorously. Meanwhile, BTRFS literally says, in 2020: Don't trust is, especially not for metadata, or data, or while scrubbing, which you had better baby-sit, otherwise say goodbye to your production environment! More fun quotes: - plan for the filesystem to be unusable during recovery. - be prepared to reboot multiple times during disk replacement. - btrfs raid5 does not provide as complete protection against on-disk data corruption as btrfs raid1 does. - scrub and dev stats report data corruption on wrong devices in raid5. - scrub sometimes counts a csum error as a read error instead on raid5. - errors during readahead operations are repaired without incrementing dev stats, discarding critical failure information. This is not just a raid5 bug, it affects all btrfs profiles. You'd have to be nuts to use BTRFS for RAID 5 or 6, and I would question its use for any form of RAID. PS: To the people downvoting this, please explain how you like people to be uninformed about catastrophic data corruption going ignored for 4 years below in the comments.

deleted 6y ago

[deleted]

petre 6y ago

Synology and SuSE are using it in production. I've been avoiding it even though we use openSuSE and it selects btrfs by default.

cjbconnor 6y ago
Synology uses a combination of btrfs and md to avoid btrfs's flaws

ansible 6y ago

> For data, it should be safe as long as a scrub is run immediately after any unclean shutdown Note that btrfs-scrub (according to the docs) is looking for on-disk block errors, comparing the data to the CRC (or whatever algo) to see if that matches. If it can recover the original data, the bad block is re-written with the correct CRC. So btrfs-scrub does not find or fix any errors with the filesystem structure. For that you need to run btrfs-check, and that can only be done offline.

8fingerlouie 6y ago
> For that you need to run btrfs-check, and that can only be done offline. You almost never want to run btrfs-check. In itself, Btrfs is fairly "self healing", and only if you run into "weird things" in the log like invalid index files should you run check, and almost certainly never with the --repair option. The thing about Btrfs (and ZFS) is that it is Copy-on-Write, and as such, new data is written to an unused part of the filesystem. It doesn't need to modify structures of existing data, thereby reducing the risk of bad metadata. A file in Btrfs is either written or it is not. If a power outage occurs after a file has been written, but before the metadata is updated, the file is not written, and in case you're updating a file, the old file is still preserved. If a crash occurs while writing metadata, Btrfs has multiple copies of metadata, and is able to repair itself online.
chasil 6y ago
The latest mkfs.btrfs on my Oracle Linux 7 supports "crc32c, xxhash, sha256 or blake2." The relative benefits are discussed in "man 5 btrfs" in the "CHECKSUM ALGORITHM" section. man 5 btrfs | col -b | sed -n '/^CHECKSUM/,/^FILESYSTEM/p'
wtallis 6y ago
The reasoning for running a scrub after an unclean shutdown is not to catch corruption of the filesystem structure, but to catch data corruption resulting from the RAID5 write hole. If you're not using RAID5 or RAID6 for metadata, the write hole won't affect the filesystem structure and there shouldn't be any issues for btrfs-check to find.
cmurf 6y ago