Add a total-size budget for OOM auto-dumps across the dump directory

The per-worker count cap doesn't bound the fleet's combined disk use: N
workers writing one large dump each can still fill the disk. Add
rdump.oom_dump_max_total (bytes, K/M/G suffixes; 0 = off). Before each auto
dump the extension sums the *.rdump files already in the target directory
(excluding the file an overwrite would replace) and skips if they meet the
budget. It is a soft, best-effort limit: concurrent workers can each pass the
check and overshoot, and counts every *.rdump in the directory. Tested in CI
via a single CLI OOM with a pre-placed filler above/below the budget.

https://claude.ai/code/session_017skw8BsHkF8wur7Pf4G9W5

Author: claude

README.md

@@ -129,10 +129,25 @@ rdump.oom_dump_max=5            ; up to 5 dumps over the worker's lifetime (0 =
 rdump.oom_dump_min_interval=60  ; ...and at least 60s apart
 ```
 
+The per-worker count still leaves the fleet total unbounded — 200 workers writing
+one 130 MB dump each is 26 GB. To cap the *combined* footprint, set a byte budget
+(accepts `K`/`M`/`G` suffixes); before each auto-dump the extension sums the
+`*.rdump` files already in the dump's directory and skips if they meet the budget:
+
+```ini
+rdump.oom_dump_max_total=2G     ; skip the auto-dump once *.rdump there totals >= 2G (0 = off)
+```
+
+Two caveats on the budget: it is a *soft* limit — concurrent workers can each pass
+the check and overshoot, and the dump that crosses the line is still written (so
+the real ceiling is roughly budget + one round of dumps). And it counts **every**
+`*.rdump` in that directory, so give OOM dumps a directory of their own if other
+`.rdump` files live alongside.
+
 A dump attempt counts toward the cap whether it succeeds or not, so a bad path or
-a full disk can't retry forever either. This guard applies only to the automatic
-OOM dump — explicit `rdump_dump()` calls are never throttled. (Combine the cap
-with a `%p` path so each worker still writes a distinct file.)
+a full disk can't retry forever either. These guards apply only to the automatic
+OOM dump — explicit `rdump_dump()` calls are never throttled. (Combine them with a
+`%p` path so each worker still writes a distinct file.)
 
 You can also toggle it at runtime — handy for a per-request/per-pid filename,
 or when you cannot edit php.ini:

ci/build-and-test.sh

@@ -189,3 +189,37 @@ if [ ! -s "$CAP_DUMP" ]; then
 fi
 echo "oom-cap (unlimited) OK"
 rm -f "$CAP_DUMP"
+
+# --- OOM auto-dump total-size budget --------------------------------
+# Unlike the per-worker count cap, the byte budget bounds the *combined*
+# footprint of every *.rdump in the dump directory, so a fleet of workers
+# cannot fill the disk one dump each. The directory is read at dump time, so
+# a single CLI OOM is enough to test it: pre-fill above the budget and the
+# dump must be skipped; drop the filler and it must be written.
+BUDGET_DIR=/tmp/rdump-budget
+rm -rf "$BUDGET_DIR"; mkdir -p "$BUDGET_DIR"
+dd if=/dev/zero of="$BUDGET_DIR/filler.rdump" bs=1024 count=2048 >/dev/null 2>&1  # 2 MiB
+
+# Over budget (2 MiB sibling, 1M cap): the OOM dump must be skipped.
+php -d extension="$SO" -d memory_limit=8M \
+    -d rdump.oom_dump="$BUDGET_DIR/oom-%p.rdump" \
+    -d rdump.oom_dump_max_total=1M \
+    -r 'function r(){ r(); } r();' >/dev/null 2>&1 || true
+if ls "$BUDGET_DIR"/oom-*.rdump >/dev/null 2>&1; then
+    echo "::error::rdump.oom_dump_max_total did not cap when over budget"
+    exit 1
+fi
+echo "oom-budget (over) OK"
+
+# Under budget (filler removed): the dump must now be written.
+rm -f "$BUDGET_DIR/filler.rdump"
+php -d extension="$SO" -d memory_limit=8M \
+    -d rdump.oom_dump="$BUDGET_DIR/oom-%p.rdump" \
+    -d rdump.oom_dump_max_total=1M \
+    -r 'function r(){ r(); } r();' >/dev/null 2>&1 || true
+if ! ls "$BUDGET_DIR"/oom-*.rdump >/dev/null 2>&1; then
+    echo "::error::rdump.oom_dump_max_total suppressed a dump while under budget"
+    exit 1
+fi
+echo "oom-budget (under) OK"
+rm -rf "$BUDGET_DIR"

php_rdump.h

@@ -32,6 +32,9 @@ ZEND_BEGIN_MODULE_GLOBALS(rdump)
      * count/last_ts are process- (per-thread-) scoped and survive RSHUTDOWN. */
     zend_long oom_dump_max;          /* rdump.oom_dump_max (INI): 0 = unlimited */
     zend_long oom_dump_min_interval; /* rdump.oom_dump_min_interval (INI), seconds; 0 = off */
+    zend_long oom_dump_max_total;    /* rdump.oom_dump_max_total (INI), bytes; 0 = off.
+                                      * Budget across all *.rdump in the dump dir,
+                                      * so many workers can't fill the disk together. */
     zend_long oom_dump_count;        /* OOM dumps attempted so far this process */
     zend_long oom_dump_last_ts;      /* time() of the last OOM dump attempt, 0 = none */
     /* Runtime override set via rdump_set_oom_dump(). Owned by us (libc

rdump.c

@@ -35,6 +35,7 @@
 #include <errno.h>
 #include <time.h>
 #include <sys/stat.h>
+#include <dirent.h>
 
 ZEND_DECLARE_MODULE_GLOBALS(rdump)
 
@@ -310,6 +311,68 @@ static int64_t rdump_rss_bytes(void)
     return (int64_t)(resident * (unsigned long long)page);
 }
 
+/* Parse a byte quantity like "500", "16K", "256M", "2G" (binary multiples,
+ * case-insensitive suffix) into bytes. Negatives / garbage -> 0. */
+static zend_long rdump_parse_bytes(const char *s)
+{
+    if (s == NULL) {
+        return 0;
+    }
+    while (*s == ' ' || *s == '\t') {
+        s++;
+    }
+    char *end = NULL;
+    long long v = strtoll(s, &end, 10);
+    if (end == s || v < 0) {
+        return 0;
+    }
+    while (*end == ' ' || *end == '\t') {
+        end++;
+    }
+    switch (*end) {
+        case 'k': case 'K': v *= 1024LL; break;
+        case 'm': case 'M': v *= 1024LL * 1024; break;
+        case 'g': case 'G': v *= 1024LL * 1024 * 1024; break;
+        case 't': case 'T': v *= 1024LL * 1024 * 1024 * 1024; break;
+        default: break;
+    }
+    return v < 0 ? 0 : (zend_long)v;
+}
+
+/* Sum the sizes of every *.rdump file in dir, skipping except_base (the file
+ * an overwrite would replace, so it must not count toward the new total).
+ * Best-effort: unreadable entries are ignored. Used to enforce a disk budget
+ * shared across all workers writing OOM dumps into the same directory. */
+static uint64_t rdump_dir_rdump_total(const char *dir, const char *except_base)
+{
+    DIR *d = opendir(dir);
+    if (!d) {
+        return 0;
+    }
+    uint64_t total = 0;
+    struct dirent *ent;
+    while ((ent = readdir(d)) != NULL) {
+        const char *n = ent->d_name;
+        size_t ln = strlen(n);
+        if (ln < 6 || strcmp(n + ln - 6, ".rdump") != 0) {
+            continue;
+        }
+        if (except_base != NULL && strcmp(n, except_base) == 0) {
+            continue;
+        }
+        char full[4096];
+        if ((size_t)snprintf(full, sizeof(full), "%s/%s", dir, n) >= sizeof(full)) {
+            continue;
+        }
+        struct stat st;
+        if (stat(full, &st) == 0 && S_ISREG(st.st_mode)) {
+            total += (uint64_t)st.st_size;
+        }
+    }
+    closedir(d);
+    return total;
+}
+
 /* ------------------------------------------------------------------ */
 /* Dump writer.                                                       */
 /* ------------------------------------------------------------------ */
@@ -588,22 +651,48 @@ static void rdump_zend_error_cb(RDUMP_ERROR_CB_PARAMS)
              * every request, so cap the auto-dump over the worker's lifetime
              * by count and/or by minimum spacing. Both gates apply together;
              * the default max of 1 keeps it to a single dump per worker. */
+            char expanded[4096];
+            const char *out_path = path;
+            if (strchr(path, '%') != NULL
+                && rdump_expand_path(path, expanded, sizeof(expanded)) == 0
+            ) {
+                out_path = expanded;
+            }
+
             zend_long max = RDUMP_G(oom_dump_max);
             zend_long interval = RDUMP_G(oom_dump_min_interval);
+            zend_long budget = RDUMP_G(oom_dump_max_total);
             zend_long now = (zend_long)time(NULL);
             int capped = (max > 0 && RDUMP_G(oom_dump_count) >= max);
             int too_soon = (interval > 0
                 && RDUMP_G(oom_dump_last_ts) != 0
                 && now - RDUMP_G(oom_dump_last_ts) < interval);
 
-            if (!capped && !too_soon) {
-                char expanded[4096];
-                const char *out_path = path;
-                if (strchr(path, '%') != NULL
-                    && rdump_expand_path(path, expanded, sizeof(expanded)) == 0
-                ) {
-                    out_path = expanded;
+            /* Disk budget: if the *.rdump files already in the target's
+             * directory (excluding the one we'd overwrite) total at or above
+             * the budget, skip -- this is the only gate that bounds the
+             * combined footprint of many workers, not just one worker's rate.
+             * Best-effort: concurrent workers can each pass and overshoot. */
+            int over_budget = 0;
+            if (!capped && !too_soon && budget > 0) {
+                char pathcopy[4096];
+                const char *dir = ".";
+                const char *base = out_path;
+                if (snprintf(pathcopy, sizeof(pathcopy), "%s", out_path)
+                        < (int)sizeof(pathcopy)) {
+                    char *slash = strrchr(pathcopy, '/');
+                    if (slash != NULL) {
+                        *slash = '\0';
+                        dir = pathcopy[0] != '\0' ? pathcopy : "/";
+                        base = slash + 1;
+                    }
+                }
+                if (rdump_dir_rdump_total(dir, base) >= (uint64_t)budget) {
+                    over_budget = 1;
                 }
+            }
+
+            if (!capped && !too_soon && !over_budget) {
                 /* Count the attempt (success or failure) and stamp the time
                  * before writing, so a broken path or full disk cannot retry
                  * without bound either. */
@@ -677,6 +766,14 @@ PHP_FUNCTION(rdump_set_oom_dump)
 /* Module plumbing.                                                   */
 /* ------------------------------------------------------------------ */
 
+/* Accept memory_limit-style sizes ("256M", "2G", ...) for the dump budget. */
+static ZEND_INI_MH(OnUpdateRdumpBytes)
+{
+    zend_long *p = (zend_long *)ZEND_INI_GET_ADDR();
+    *p = rdump_parse_bytes(ZSTR_VAL(new_value));
+    return SUCCESS;
+}
+
 PHP_INI_BEGIN()
     STD_PHP_INI_ENTRY(
         "rdump.oom_dump", "", PHP_INI_SYSTEM, OnUpdateString,
@@ -694,6 +791,10 @@ PHP_INI_BEGIN()
         "rdump.oom_dump_min_interval", "0", PHP_INI_SYSTEM, OnUpdateLong,
         oom_dump_min_interval, zend_rdump_globals, rdump_globals
     )
+    STD_PHP_INI_ENTRY(
+        "rdump.oom_dump_max_total", "0", PHP_INI_SYSTEM, OnUpdateRdumpBytes,
+        oom_dump_max_total, zend_rdump_globals, rdump_globals
+    )
 PHP_INI_END()
 
 static const zend_function_entry rdump_functions[] = {
@@ -711,6 +812,7 @@ static PHP_GINIT_FUNCTION(rdump)
     rdump_globals->oom_dump_full = 0;
     rdump_globals->oom_dump_max = 1;
     rdump_globals->oom_dump_min_interval = 0;
+    rdump_globals->oom_dump_max_total = 0;
     rdump_globals->oom_dump_count = 0;
     rdump_globals->oom_dump_last_ts = 0;
     rdump_globals->oom_dump_runtime = NULL;