Require F_ALLOCATEALL on Apple fallocate

src/backend/libc/fs/syscalls.rs

@@ -1808,7 +1808,9 @@ pub(crate) fn fallocate(
 
     let new_len = offset.checked_add(len).ok_or(io::Errno::FBIG)?;
     let mut store = c::fstore_t {
-        fst_flags: c::F_ALLOCATECONTIG,
+        // `F_ALLOCATEALL` is required. Without it, `F_PREALLOCATE` may
+        // succeed after reserving only a fraction of `fst_length`.
+        fst_flags: c::F_ALLOCATECONTIG | c::F_ALLOCATEALL,
         fst_posmode: c::F_PEOFPOSMODE,
         fst_offset: 0,
         fst_length: new_len,
@@ -1817,9 +1819,9 @@ pub(crate) fn fallocate(
     unsafe {
         if c::fcntl(borrowed_fd(fd), c::F_PREALLOCATE, &store) == -1 {
             // Unable to allocate contiguous disk space; attempt to allocate
-            // non-contiguously.
+            // non-contiguously, still all-or-nothing.
             store.fst_flags = c::F_ALLOCATEALL;
-            let _ = ret_c_int(c::fcntl(borrowed_fd(fd), c::F_PREALLOCATE, &store))?;
+            ret_c_int(c::fcntl(borrowed_fd(fd), c::F_PREALLOCATE, &store))?;
         }
         ret(c::ftruncate(borrowed_fd(fd), new_len))
     }

tests/fs/fallocate.rs

@@ -0,0 +1,31 @@
+//! Apple `F_PREALLOCATE` without `F_ALLOCATEALL` can return success after
+//! allocating only a fraction of the requested length.
+
+#![cfg(apple)]
+
+use rustix::fs::{fallocate, fstat, fsync, openat, FallocateFlags, Mode, OFlags, CWD};
+
+#[test]
+fn apple_fallocate_reserves_requested_space() {
+    let tmp = tempfile::tempdir().unwrap();
+    let dir = openat(CWD, tmp.path(), OFlags::RDONLY, Mode::empty()).unwrap();
+    let file = openat(
+        &dir,
+        "file",
+        OFlags::RDWR | OFlags::TRUNC | OFlags::CREATE,
+        Mode::RUSR | Mode::WUSR,
+    )
+    .unwrap();
+
+    // Large enough that a partial `F_ALLOCATECONTIG` allocation (a few MiB)
+    // would fall short of the request.
+    let requested = 16 * 1024 * 1024;
+    fallocate(&file, FallocateFlags::empty(), 0, requested).unwrap();
+    fsync(&file).unwrap();
+
+    let allocated = fstat(&file).unwrap().st_blocks as u64 * 512;
+    assert!(
+        allocated >= requested,
+        "fallocate reported success after reserving {allocated} of {requested} bytes"
+    );
+}

tests/fs/main.rs

@@ -7,6 +7,8 @@
 mod chmodat;
 #[cfg(not(target_os = "redox"))]
 mod dir;
+#[cfg(apple)]
+mod fallocate;
 mod fcntl;
 #[cfg(not(any(
     target_os = "emscripten",