[PATCH] xfs: reserve a full directory block when repair expands the tempdir

[PATCH] xfs: reserve a full directory block when repair expands the tempdir

[Javier Tia]

xrep_dir_swap_prep() passes args.total = 1 to xfs_dir2_sf_to_block(),
but the conversion allocates args->geo->fsbcount filesystem blocks,
which is 1 << sb_dirblklog.  The two agree only when the directory
block size equals the filesystem block size, so the shortfall is
invisible on a 4k block filesystem and is four blocks on a 1k block
filesystem carrying a 4k directory block size.  xfs_da_grow_inode_int()
then subtracts more blocks than total ever held, underflowing it, and
hands the understated value to xfs_bmapi_write() as the remaining-space
hint the allocator sizes minleft from.

fsbcount is what the other caller of this conversion already reserves:
xfs_bmap_add_attrfork_local() sets dargs.total the same way, and it is
exactly what the single xfs_dir2_grow_inode() call underneath consumes.
The attribute counterpart in xrep_xattr_swap_prep() keeps its literal 1
because m_attr_geo->fsbcount is always 1.

Found by the reservation assert in xfs_da_grow_inode_int(), which Dave
Chinner hit running xfs/286 at 1k block size.

Fixes: b1991ee3e7cf ("xfs: online repair of directories")
Reported-by: Dave Chinner <dgc@kernel.org>
Closes: https://lore.kernel.org/linux-xfs/ap-mIH9nTNkpWq9K@dread/
Signed-off-by: Javier Tia <javier@peridio.com>
---
 fs/xfs/scrub/dir_repair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 31a23c5f386a..0a3d02d8f041 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1488,7 +1488,7 @@ xrep_dir_swap_prep(
 			.geo		= sc->mp->m_dir_geo,
 			.whichfork	= XFS_DATA_FORK,
 			.trans		= sc->tp,
-			.total		= 1,
+			.total		= sc->mp->m_dir_geo->fsbcount,
 			.owner		= I_INO(sc->ip),
 		};
 

---
base-commit: 0ca15a1a115132dfebeee5447fd6abe46f66d61d
change-id: 20260908-b4-xrep-dir-total-3c77d0bcff51

Best regards,
-- 
Javier Tia <javier@peridio.com>

Re: [PATCH] xfs: reserve a full directory block when repair expands the tempdir

[Darrick J. Wong]

On Tue, Sep 08, 2026 at 10:16:12AM -0600, Javier Tia wrote:
> xrep_dir_swap_prep() passes args.total = 1 to xfs_dir2_sf_to_block(),
> but the conversion allocates args->geo->fsbcount filesystem blocks,
> which is 1 << sb_dirblklog.  The two agree only when the directory
> block size equals the filesystem block size, so the shortfall is
> invisible on a 4k block filesystem and is four blocks on a 1k block
> filesystem carrying a 4k directory block size.  xfs_da_grow_inode_int()
> then subtracts more blocks than total ever held, underflowing it, and
> hands the understated value to xfs_bmapi_write() as the remaining-space
> hint the allocator sizes minleft from.
> 
> fsbcount is what the other caller of this conversion already reserves:
> xfs_bmap_add_attrfork_local() sets dargs.total the same way, and it is
> exactly what the single xfs_dir2_grow_inode() call underneath consumes.
> The attribute counterpart in xrep_xattr_swap_prep() keeps its literal 1
> because m_attr_geo->fsbcount is always 1.
> 
> Found by the reservation assert in xfs_da_grow_inode_int(), which Dave
> Chinner hit running xfs/286 at 1k block size.
> 
> Fixes: b1991ee3e7cf ("xfs: online repair of directories")
> Reported-by: Dave Chinner <dgc@kernel.org>
> Closes: https://lore.kernel.org/linux-xfs/ap-mIH9nTNkpWq9K@dread/
> Signed-off-by: Javier Tia <javier@peridio.com>
> ---
>  fs/xfs/scrub/dir_repair.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
> index 31a23c5f386a..0a3d02d8f041 100644
> --- a/fs/xfs/scrub/dir_repair.c
> +++ b/fs/xfs/scrub/dir_repair.c
> @@ -1488,7 +1488,7 @@ xrep_dir_swap_prep(
>  			.geo		= sc->mp->m_dir_geo,
>  			.whichfork	= XFS_DATA_FORK,
>  			.trans		= sc->tp,
> -			.total		= 1,
> +			.total		= sc->mp->m_dir_geo->fsbcount,

This is enough to shut up the assertion, but it doesn't fix the
additional problem that the block reservation in sc->tp can also
underrun for this same reason.  I'm testing a fixpatch for both, please
be patient...

--D

>  			.owner		= I_INO(sc->ip),
>  		};
>  
> 
> ---
> base-commit: 0ca15a1a115132dfebeee5447fd6abe46f66d61d
> change-id: 20260908-b4-xrep-dir-total-3c77d0bcff51
> 
> Best regards,
> -- 
> Javier Tia <javier@peridio.com>
>