Zhengchao An 5a372557e5 fix(object-capacity): bound wedged scans with a hard outer timeout and cap joiner waits (#4533) ...

The whole disk traversal runs inside spawn_blocking with no timeout
anywhere on the async side; the in-scan ProgressMonitor checks are
cooperative and only run between walker entries. A stat/readdir blocked
on a dying disk or hung NFS mount therefore never returns: the blocking
thread leaks, the refresh singleflight stays running forever, every
subsequent scheduled refresh is skipped as inflight, and every admin
capacity query joins an unbounded wait until process restart (S02).

- Wrap each disk scan in tokio::time::timeout with a hard wall-clock
  ceiling of 2x the cooperative budget (min 5s). On expiry the caller
  fails the disk scan (releasing the singleflight through the normal
  error path, where the degraded/partial machinery from backlog#1014
  keeps the failed disk's last-known value) and a shared AtomicBool asks
  the blocking walker to exit at its next entry, bounding the thread
  leak to the single wedged syscall.
- Bound refresh_or_join joiner waits at 5 minutes so admin queries
  degrade into a clear error instead of hanging if the leader wedges in
  a way the drop/panic guards don't cover.

Ref: rustfs/backlog#1017 (S02 from audit rustfs/backlog#1010)

2026-07-09 01:22:22 +08:00

..

capacity_manager.rs

fix(object-capacity): bound wedged scans with a hard outer timeout and cap joiner waits (#4533)

2026-07-09 01:22:22 +08:00

capacity_scope.rs

refactor(s3): consolidate semantic boundaries and remove s3-common (#3012)

2026-05-19 12:50:25 +00:00

lib.rs

refactor(s3): consolidate semantic boundaries and remove s3-common (#3012)

2026-05-19 12:50:25 +00:00

scan.rs

fix(object-capacity): bound wedged scans with a hard outer timeout and cap joiner waits (#4533)

2026-07-09 01:22:22 +08:00

types.rs

fix(capacity): harden scope registry, scan symlink guard, and test temp dir cleanup (#2432)

2026-04-08 20:58:17 +08:00