Skip to content

out_s3: Address underflow of buffer size on startup - #12266

Open
cosmo0920 wants to merge 4 commits into
masterfrom
cosmo0920-prevent-underflow-on-startup
Open

out_s3: Address underflow of buffer size on startup#12266
cosmo0920 wants to merge 4 commits into
masterfrom
cosmo0920-prevent-underflow-on-startup

Conversation

@cosmo0920

@cosmo0920 cosmo0920 commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Implemented the complete fix. This is an S3 accounting underflow, not ordinary backpressure.

Key changes:

  • Restored files are credited to current_buffer_size during startup.
  • Buffer/file counters use cross-platform atomic compare-and-swap updates.
  • Limit checking and space reservation are one atomic operation.
  • Subtraction clamps to zero instead of wrapping to 2^64 − N.
  • Quarantine accounting is synchronized too.
  • Added a restart regression reproducing leftover upload followed by a new upload.

Verification passed:

  • cmake --build build -j8
  • ctest --test-dir build -R '^flb-rt-out_s3$' --output-on-failure
  • tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_s3/tests/test_out_s3_001.py -q — 10 passed, 2 skipped
  • LEAKS=1 LEAKS_STRICT=1 tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_s3/tests/test_out_s3_001.py -q — 10 passed, 2 skipped; strict macOS Leaks clean

Closes #12164 #12149.


Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

  • Example configuration file for the change
  • Debug log output from testing the change
  • Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

  • Run local packaging test showing all targets (including any new ones) build.
  • Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

  • Documentation required for this feature

Backporting

  • Backport to latest stable release.

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

  • Bug Fixes

    • Improved S3 buffer and quarantine capacity tracking, including safer handling near storage limits.
    • Ensured failed uploads are correctly retained and retried after restart.
    • Improved cleanup behavior when retries are exhausted or quarantine storage is full.
    • Improved file-size tracking for large buffered uploads.
  • Tests

    • Added coverage for buffer accounting across shutdown, restart, and upload retry scenarios.

Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 23d1cead-fe80-4f5a-8f8d-990a7b85398b

📥 Commits

Reviewing files that changed from the base of the PR and between 92f597a and 063e7cd.

📒 Files selected for processing (1)
  • tests/runtime/out_s3.c
🚧 Files skipped from review as they are similar to previous changes (1)
  • tests/runtime/out_s3.c

📝 Walkthrough

Walkthrough

The S3 output now uses atomic buffer and quarantine accounting, restores usage for existing files, exposes atomic file-size reads, and handles quota-aware cleanup. Runtime tests cover near-limit appends and restart recovery.

Changes

S3 storage accounting

Layer / File(s) Summary
Atomic buffer accounting
plugins/out_s3/s3_store.h, plugins/out_s3/s3.h, plugins/out_s3/s3_store.c
Buffer sizes and file sizes use uint64_t. Atomic reservation, release, overflow, underflow, and failure rollback handling was added.
Recovery and quarantine lifecycle
plugins/out_s3/s3_store.c, plugins/out_s3/s3.c
Recovered files restore buffer accounting. Quarantine operations enforce capacity and update counters. Upload checks and retry cleanup use atomic file-size reads and quota-aware quarantine handling.
Runtime validation
tests/runtime/out_s3.c
Tests verify near-limit appends and persistence, accounting restoration, and resend behavior after restart.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The changes satisfy [#12164] by restoring startup accounting, preventing underflow, enforcing limits, and testing restart behavior.
Out of Scope Changes check ✅ Passed The atomic accounting, quarantine handling, deletion safeguards, and regression tests directly support the linked issue objectives.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely identifies the main change: fixing out_s3 buffer accounting underflow during startup.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cosmo0920-prevent-underflow-on-startup

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc8eef071e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/out_s3/s3_store.c Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
plugins/out_s3/s3_store.h (1)

36-36: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Parenthesize the negative macro value.

S3_STORE_QUARANTINE_FULL expands to a bare -2. Any use in a larger expression, for example x - S3_STORE_QUARANTINE_FULL, changes meaning. Wrap the value in parentheses.

♻️ Proposed change
-#define S3_STORE_QUARANTINE_FULL -2
+#define S3_STORE_QUARANTINE_FULL (-2)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/out_s3/s3_store.h` at line 36, Update the S3_STORE_QUARANTINE_FULL
macro to expand to the parenthesized value (-2), preserving its numeric value
while ensuring safe use in larger expressions.
plugins/out_s3/s3_store.c (1)

99-102: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Align the limit comparison with quarantine_size_reserve.

buffer_size_reserve rejects when updated_size >= ctx->store_dir_limit_size. quarantine_size_reserve rejects only when updated_size > ctx->quarantine_dir_limit_size. The two helpers therefore treat an exactly-at-limit write differently, and store_dir_limit_size rejects a write that would land exactly on the configured limit.

If the strict >= is intentional to preserve the previous out_s3 behavior, add a short /* ... */ comment. Otherwise use > in both helpers.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/out_s3/s3_store.c` around lines 99 - 102, Align the boundary behavior
in buffer_size_reserve with quarantine_size_reserve by changing the
store_dir_limit_size comparison to reject only when updated_size is greater than
the limit; if retaining the existing >= behavior, add a brief inline comment
documenting that intentional difference.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@plugins/out_s3/s3_store.c`:
- Around line 335-343: Update the near-full limit check in buffer_chunk so the
warning after a successful append does not return -1 or otherwise signal retry.
Preserve the warning and return success after the buffer-size update, or move
the check before the append while ensuring the event is not appended twice.

---

Nitpick comments:
In `@plugins/out_s3/s3_store.c`:
- Around line 99-102: Align the boundary behavior in buffer_size_reserve with
quarantine_size_reserve by changing the store_dir_limit_size comparison to
reject only when updated_size is greater than the limit; if retaining the
existing >= behavior, add a brief inline comment documenting that intentional
difference.

In `@plugins/out_s3/s3_store.h`:
- Line 36: Update the S3_STORE_QUARANTINE_FULL macro to expand to the
parenthesized value (-2), preserving its numeric value while ensuring safe use
in larger expressions.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ee17859e-d50b-4909-a68d-2c1b6fd0ff60

📥 Commits

Reviewing files that changed from the base of the PR and between ae51533 and bc8eef0.

📒 Files selected for processing (5)
  • plugins/out_s3/s3.c
  • plugins/out_s3/s3.h
  • plugins/out_s3/s3_store.c
  • plugins/out_s3/s3_store.h
  • tests/runtime/out_s3.c

Comment thread plugins/out_s3/s3_store.c Outdated
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/runtime/out_s3.c`:
- Around line 1097-1142: The near-full test around s3_store_buffer_put must also
cover an append exceeding the 100-byte store_dir_limit_size. After the
successful 96-byte append, call s3_store_buffer_put with an additional payload
that crosses the limit, assert it fails, and verify s3_ctx->current_buffer_size
and s3_store_file_size_get(s3_file) both remain 96 bytes.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7877f431-2816-4b45-9340-8490595c6d4f

📥 Commits

Reviewing files that changed from the base of the PR and between bc8eef0 and 92f597a.

📒 Files selected for processing (2)
  • plugins/out_s3/s3_store.c
  • tests/runtime/out_s3.c
🚧 Files skipped from review as they are similar to previous changes (1)
  • plugins/out_s3/s3_store.c

Comment thread tests/runtime/out_s3.c
Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
@cosmo0920 cosmo0920 changed the title out_s3: Address underflow on startup out_s3: Address underflow of buffer size on startup Aug 12, 2026
@cosmo0920 cosmo0920 added this to the Fluent Bit v5.1.1 milestone Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

out_s3: current_buffer_size underflows at startup when store_dir has leftover files — output permanently rejects data ('Buffer is full')

1 participant