{ "@context": "https://schema.org", "@id": "https://aggr.aymericbeaumet.com/items/andrewkelley-me/2025-07-14-openzfs-bug-ported-to-zig/#webpage", "@type": [ "WebPage", "ArchiveComponent" ], "articleBody": "Someone on IRC shared this link with me: [An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too)](https://despairlabs.com/blog/posts/2025-07-10-an-openzfs-bug-and-the-humans-that-made-it/)\n\nThey wanted to know, would Zig catch this?\n\nI went through the trouble of porting the code snippet to Zig, so I thought I'd go the next step and turn it into a small blog post.\n\nOriginal snippet, in C:\n\n```\n/*\n * This code converts an asize into the largest psize that can safely be written\n * to an allocation of that size for this vdev.\n *\n * Note that this function will not take into account the effect of gang\n * headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n * the psize_to_asize function.\n */\nstatic uint64_t\nvdev_raidz_asize_to_psize(vdev_t *vd, uint64_t asize, uint64_t txg)\n{\n\tvdev_raidz_t *vdrz = vd->vdev_tsd;\n\tuint64_t psize;\n\tuint64_t ashift = vd->vdev_top->vdev_ashift;\n\tuint64_t cols = vdrz->vd_original_width;\n\tuint64_t nparity = vdrz->vd_nparity;\n\n\tcols = vdev_raidz_get_logical_width(vdrz, txg);\n\n\tASSERT0(asize % (1 << ashift));\n\n\tpsize = (asize >> ashift);\n\tpsize -= nparity * DIV_ROUND_UP(psize, cols);\n\tpsize <<= ashift;\n\n\treturn (asize);\n}\n```\n\nThe blog post author encourages us to try to [spot the fail](https://andrewkelley.me/post/spot-the-fail.html) before the answer is revealed.\n\nI couldn't do it before getting bored, so I ported the code to Zig instead:\n\n```\nconst std = @import(\"std\");\nconst divCeil = std.math.divCeil;\nconst assert = std.debug.assert;\nconst vdev_t = @import(\"the_rest_of_the_software.zig\").vdev_t;\n\n/// This code converts an asize into the largest psize that can safely be written\n/// to an allocation of that size for this vdev.\n///\n/// Note that this function will not take into account the effect of gang\n/// headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n/// the psize_to_asize function.\nfn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n const vdrz = vd.vdev_tsd;\n const ashift = vd.vdev_top.vdev_ashift;\n const cols = vdrz.vd_original_width;\n const nparity = vdrz.vd_nparity;\n\n const cols = vdrz.get_logical_width(txg);\n\n assert(asize % (1 << ashift));\n\n const asize_shifted = (asize >> ashift);\n const parity_adjusted = asize_shifted - nparity * (divCeil(asize_shifted, cols) catch unreachable);\n const psize = parity_adjusted << ashift;\n\n return asize;\n}\n```\n\nLet's start with the code formatting tool alone, `zig fmt`:\n\n```\nandy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:18:11: error: redeclaration of local constant 'cols'\n const cols = vdrz.get_logical_width(txg);\n ^~~~\nbug.zig:15:11: note: previous declaration here\n const cols = vdrz.vd_original_width;\n ^~~~\n```\n\nHmm, alright. That's definitely strange. The original blog post didn't notice that the initialization value of `cols` is dead code. That doesn't look like a logic error though. Let's fix it and try again:\n\n```\n@@ -12,7 +12,6 @@\n fn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n const vdrz = vd.vdev_tsd;\n const ashift = vd.vdev_top.vdev_ashift;\n- const cols = vdrz.vd_original_width;\n const nparity = vdrz.vd_nparity;\n\n const cols = vdrz.get_logical_width(txg);\n```\n\n```\nandy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:23:11: error: unused local constant\n const psize = parity_adjusted << ashift;\n ^~~~~\n```\n\nBingo. We didn't even have to use the type checker.\n\nThanks for reading my blog post.\n", "authors": [], "captured_at": "2026-09-19T21:30:23.395188495+00:00", "category": "programming", "content_html": "

Someone on IRC shared this link with me: An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too)

\n

They wanted to know, would Zig catch this?

\n

I went through the trouble of porting the code snippet to Zig, so I thought I'd go the next step and turn it into a small blog post.

\n

Original snippet, in C:

\n
/*\n * This code converts an asize into the largest psize that can safely be written\n * to an allocation of that size for this vdev.\n *\n * Note that this function will not take into account the effect of gang\n * headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n * the psize_to_asize function.\n */\nstatic uint64_t\nvdev_raidz_asize_to_psize(vdev_t *vd, uint64_t asize, uint64_t txg)\n{\n\tvdev_raidz_t *vdrz = vd->vdev_tsd;\n\tuint64_t psize;\n\tuint64_t ashift = vd->vdev_top->vdev_ashift;\n\tuint64_t cols = vdrz->vd_original_width;\n\tuint64_t nparity = vdrz->vd_nparity;\n\n\tcols = vdev_raidz_get_logical_width(vdrz, txg);\n\n\tASSERT0(asize % (1 << ashift));\n\n\tpsize = (asize >> ashift);\n\tpsize -= nparity * DIV_ROUND_UP(psize, cols);\n\tpsize <<= ashift;\n\n\treturn (asize);\n}\n
\n

The blog post author encourages us to try to spot the fail before the answer is revealed.

\n

I couldn't do it before getting bored, so I ported the code to Zig instead:

\n
const std = @import("std");\nconst divCeil = std.math.divCeil;\nconst assert = std.debug.assert;\nconst vdev_t = @import("the_rest_of_the_software.zig").vdev_t;\n\n/// This code converts an asize into the largest psize that can safely be written\n/// to an allocation of that size for this vdev.\n///\n/// Note that this function will not take into account the effect of gang\n/// headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n/// the psize_to_asize function.\nfn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n    const vdrz = vd.vdev_tsd;\n    const ashift = vd.vdev_top.vdev_ashift;\n    const cols = vdrz.vd_original_width;\n    const nparity = vdrz.vd_nparity;\n\n    const cols = vdrz.get_logical_width(txg);\n\n    assert(asize % (1 << ashift));\n\n    const asize_shifted = (asize >> ashift);\n    const parity_adjusted = asize_shifted - nparity * (divCeil(asize_shifted, cols) catch unreachable);\n    const psize = parity_adjusted << ashift;\n\n    return asize;\n}\n
\n

Let's start with the code formatting tool alone, zig fmt:

\n
andy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:18:11: error: redeclaration of local constant 'cols'\n    const cols = vdrz.get_logical_width(txg);\n          ^~~~\nbug.zig:15:11: note: previous declaration here\n    const cols = vdrz.vd_original_width;\n          ^~~~\n
\n

Hmm, alright. That's definitely strange. The original blog post didn't notice that the initialization value of cols is dead code. That doesn't look like a logic error though. Let's fix it and try again:

\n
@@ -12,7 +12,6 @@\n fn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n     const vdrz = vd.vdev_tsd;\n     const ashift = vd.vdev_top.vdev_ashift;\n-    const cols = vdrz.vd_original_width;\n     const nparity = vdrz.vd_nparity;\n\n     const cols = vdrz.get_logical_width(txg);\n
\n
andy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:23:11: error: unused local constant\n    const psize = parity_adjusted << ashift;\n          ^~~~~\n
\n

Bingo. We didn't even have to use the type checker.

\n

Thanks for reading my blog post.

\n", "content_markdown": "Someone on IRC shared this link with me: [An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too)](https://despairlabs.com/blog/posts/2025-07-10-an-openzfs-bug-and-the-humans-that-made-it/)\n\nThey wanted to know, would Zig catch this?\n\nI went through the trouble of porting the code snippet to Zig, so I thought I'd go the next step and turn it into a small blog post.\n\nOriginal snippet, in C:\n\n```\n/*\n * This code converts an asize into the largest psize that can safely be written\n * to an allocation of that size for this vdev.\n *\n * Note that this function will not take into account the effect of gang\n * headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n * the psize_to_asize function.\n */\nstatic uint64_t\nvdev_raidz_asize_to_psize(vdev_t *vd, uint64_t asize, uint64_t txg)\n{\n\tvdev_raidz_t *vdrz = vd->vdev_tsd;\n\tuint64_t psize;\n\tuint64_t ashift = vd->vdev_top->vdev_ashift;\n\tuint64_t cols = vdrz->vd_original_width;\n\tuint64_t nparity = vdrz->vd_nparity;\n\n\tcols = vdev_raidz_get_logical_width(vdrz, txg);\n\n\tASSERT0(asize % (1 << ashift));\n\n\tpsize = (asize >> ashift);\n\tpsize -= nparity * DIV_ROUND_UP(psize, cols);\n\tpsize <<= ashift;\n\n\treturn (asize);\n}\n```\n\nThe blog post author encourages us to try to [spot the fail](https://andrewkelley.me/post/spot-the-fail.html) before the answer is revealed.\n\nI couldn't do it before getting bored, so I ported the code to Zig instead:\n\n```\nconst std = @import(\"std\");\nconst divCeil = std.math.divCeil;\nconst assert = std.debug.assert;\nconst vdev_t = @import(\"the_rest_of_the_software.zig\").vdev_t;\n\n/// This code converts an asize into the largest psize that can safely be written\n/// to an allocation of that size for this vdev.\n///\n/// Note that this function will not take into account the effect of gang\n/// headers, which also modify the ASIZE of the DVAs. It is purely a reverse of\n/// the psize_to_asize function.\nfn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n const vdrz = vd.vdev_tsd;\n const ashift = vd.vdev_top.vdev_ashift;\n const cols = vdrz.vd_original_width;\n const nparity = vdrz.vd_nparity;\n\n const cols = vdrz.get_logical_width(txg);\n\n assert(asize % (1 << ashift));\n\n const asize_shifted = (asize >> ashift);\n const parity_adjusted = asize_shifted - nparity * (divCeil(asize_shifted, cols) catch unreachable);\n const psize = parity_adjusted << ashift;\n\n return asize;\n}\n```\n\nLet's start with the code formatting tool alone, `zig fmt`:\n\n```\nandy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:18:11: error: redeclaration of local constant 'cols'\n const cols = vdrz.get_logical_width(txg);\n ^~~~\nbug.zig:15:11: note: previous declaration here\n const cols = vdrz.vd_original_width;\n ^~~~\n```\n\nHmm, alright. That's definitely strange. The original blog post didn't notice that the initialization value of `cols` is dead code. That doesn't look like a logic error though. Let's fix it and try again:\n\n```\n@@ -12,7 +12,6 @@\n fn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 {\n const vdrz = vd.vdev_tsd;\n const ashift = vd.vdev_top.vdev_ashift;\n- const cols = vdrz.vd_original_width;\n const nparity = vdrz.vd_nparity;\n\n const cols = vdrz.get_logical_width(txg);\n```\n\n```\nandy@bark ~/tmp> zig fmt bug.zig --ast-check\nbug.zig:23:11: error: unused local constant\n const psize = parity_adjusted << ashift;\n ^~~~~\n```\n\nBingo. We didn't even have to use the type checker.\n\nThanks for reading my blog post.\n", "dateCreated": "2026-09-19T21:30:23.395188495+00:00", "date_created": "2025-07-14T18:31:28+00:00", "date_modified": "2025-07-14T18:31:28+00:00", "date_published": "2025-07-14T18:31:28+00:00", "description": "OpenZFS Bug Ported to Zig Someone on IRC shared this link with me: An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too) They wanted to know, would Zig catch this? I went through the trouble of porting the…", "external_url": "https://andrewkelley.me/post/openzfs-bug-ported-zig.html", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/andrewkelley-me/2025/07/2025-07-14-openzfs-bug-ported-to-zig.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/andrewkelley-me/2025/07/2025-07-14-openzfs-bug-ported-to-zig.md" }, "id": "urn:aggr:item:5080c170368e636c3644cef0e75cdf5d8a6591f2", "isBasedOn": { "@id": "https://andrewkelley.me/post/openzfs-bug-ported-zig.html" }, "mainEntity": { "@id": "https://andrewkelley.me/post/openzfs-bug-ported-zig.html", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/andrewkelley-me/2025-07-14-openzfs-bug-ported-to-zig/#webpage" }, "dateModified": "2025-07-14T18:31:28+00:00", "datePublished": "2025-07-14T18:31:28+00:00", "headline": "OpenZFS Bug Ported to Zig", "timeRequired": "PT3M", "url": "https://andrewkelley.me/post/openzfs-bug-ported-zig.html", "wordCount": 452 }, "name": "Archived snapshot: OpenZFS Bug Ported to Zig", "preview": null, "reading_minutes": 3, "replicated_at": null, "source": "andrewkelley-me", "source_name": "Andrew Kelley", "summary": "OpenZFS Bug Ported to Zig Someone on IRC shared this link with me: An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too) They wanted to know, would Zig catch this? I went through the trouble of porting the code snippet to Zig, so I thought I'd go the next step and turn it into a small blog post. Original snippet, in C: /* * This code converts an asize into the largest psize that can safely be written * to an allocation of that size for this vdev. * * Note that this function will not take into account the effect of gang * headers, which also modify the ASIZE of the DVAs. It is purely a reverse of * the psize_to_asize function. */ static uint64_t vdev_raidz_asize_to_psize(vdev_t *vd, uint64_t asize, uint64_t txg) { vdev_raidz_t *vdrz = vd->vdev_tsd; uint64_t psize; uint64_t ashift = vd->vdev_top->vdev_ashift; uint64_t cols = vdrz->vd_original_width; uint64_t nparity = vdrz->vd_nparity; cols = vdev_raidz_get_logical_width(vdrz, txg); ASSERT0(asize % (1 << ashift)); psize = (asize >> ashift); psize -= nparity * DIV_ROUND_UP(psize, cols); psize <<= ashift; return (asize); } The blog post author encourages us to try to spot the fail before the answer is revealed. I couldn't do it before getting bored, so I ported the code to Zig instead: const std = @import(\"std\"); const divCeil = std.math.divCeil; const assert = std.debug.assert; const vdev_t = @import(\"the_rest_of_the_software.zig\").vdev_t; /// This code converts an asize into the largest psize that can safely be written /// to an allocation of that size for this vdev. /// /// Note that this function will not take into account the effect of gang /// headers, which also modify the ASIZE of the DVAs. It is purely a reverse of /// the psize_to_asize function. fn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 { const vdrz = vd.vdev_tsd; const ashift = vd.vdev_top.vdev_ashift; const cols = vdrz.vd_original_width; const nparity = vdrz.vd_nparity; const cols = vdrz.get_logical_width(txg); assert(asize % (1 << ashift)); const asize_shifted = (asize >> ashift); const parity_adjusted = asize_shifted - nparity * (divCeil(asize_shifted, cols) catch unreachable); const psize = parity_adjusted << ashift; return asize; } Let's start with the code formatting tool alone, zig fmt: andy@bark ~/tmp> zig fmt bug.zig --ast-check bug.zig:18:11: error: redeclaration of local constant 'cols' const cols = vdrz.get_logical_width(txg); ^~~~ bug.zig:15:11: note: previous declaration here const cols = vdrz.vd_original_width; ^~~~ Hmm, alright. That's definitely strange. The original blog post didn't notice that the initialization value of cols is dead code. That doesn't look like a logic error though. Let's fix it and try again: @@ -12,7 +12,6 @@ fn vdev_raidz_asize_to_psize(vd: *vdev_t, asize: u64, txg: u64) u64 { const vdrz = vd.vdev_tsd; const ashift = vd.vdev_top.vdev_ashift; - const cols = vdrz.vd_original_width; const nparity = vdrz.vd_nparity; const cols = vdrz.get_logical_width(txg); andy@bark ~/tmp> zig fmt bug.zig --ast-check bug.zig:23:11: error: unused local constant const psize = parity_adjusted << ashift; ^~~~~ Bingo. We didn't even have to use the type checker.", "tags": [], "temporalCoverage": "2026-09-19T21:30:23.395188495+00:00", "title": "OpenZFS Bug Ported to Zig", "url": "https://aggr.aymericbeaumet.com/items/andrewkelley-me/2025-07-14-openzfs-bug-ported-to-zig/", "word_count": 452 }