Method to detect file corruption from the bclone issue in 2.2.0?

[bitmagewb]

Is there any script or other method that can detect files corrupted by the block cloning feature bug (#15526) in v2.2.0? Zpool scrubs do not appear to be able to catch this silent data corruption.

It looks like you'd need to search for blocks of zeroes, but I wasn't clear if there was any known signature (ex, always 32 blocks, etc) that would help in locating potentially damaged files.

[rincebrain]

Nope.

It would always, I think, be some integer amount of records of whatever record size the file that was copied from was, but that might not be the same record size as the destination, since you're not trying to clone into that, so...practically you could probably often use that as a heuristic, but it's not an absolutely accurate thing.

[bitmagewb]

Found https://github.com/0x5c/zfs-bclonecheck digging through the threads but haven't tried it yet. Needs an updated version of zdb to be able to dump the BRT.

[bitmagewb]

Got that running after building from source, most of the files it showed as affected on my system are things that change rapidly enough that they wouldn't benefit from being restored from backup (firefox sqlite dbs, etc). Fingers crossed that nothing more was affected.

[robn]

zfs-bclonecheck won't really help you here. The clone was never made, so there won't be a record of it.

[bitmagewb]

Foo. Rince's comments in #15554 helped me understand better. So other than looking for 'zeroes where none normally occur', there's no real way to scan for this.

[robn]

Correct.

Now I think about it, if a file contains multiple blocks, then the likelihood is that most were cloned correctly, and one was broken. So you could identify the cloned files and then check them. For single-block files though (ie <recordsize), there's no real way other than checking contents.

[robn]

Its worth noting that this should be a pretty difficult bug to hit. Just casually copying files is unlikely to trip anything. Its more likely when there's a lot of copying (cloning) and modification of the same files or clones of files in parallel. This is why we've only seen it in things like parallel build systems, and why its so difficult to reproduce reliably. If you're just copying existing files around at no great pace, you're probably fine.