Re: [PATCH] xfs: reserve a full directory block when repair expands the tempdir

[Darrick J. Wong]

On Tue, Sep 08, 2026 at 10:16:12AM -0600, Javier Tia wrote:
> xrep_dir_swap_prep() passes args.total = 1 to xfs_dir2_sf_to_block(),
> but the conversion allocates args->geo->fsbcount filesystem blocks,
> which is 1 << sb_dirblklog.  The two agree only when the directory
> block size equals the filesystem block size, so the shortfall is
> invisible on a 4k block filesystem and is four blocks on a 1k block
> filesystem carrying a 4k directory block size.  xfs_da_grow_inode_int()
> then subtracts more blocks than total ever held, underflowing it, and
> hands the understated value to xfs_bmapi_write() as the remaining-space
> hint the allocator sizes minleft from.
> 
> fsbcount is what the other caller of this conversion already reserves:
> xfs_bmap_add_attrfork_local() sets dargs.total the same way, and it is
> exactly what the single xfs_dir2_grow_inode() call underneath consumes.
> The attribute counterpart in xrep_xattr_swap_prep() keeps its literal 1
> because m_attr_geo->fsbcount is always 1.
> 
> Found by the reservation assert in xfs_da_grow_inode_int(), which Dave
> Chinner hit running xfs/286 at 1k block size.
> 
> Fixes: b1991ee3e7cf ("xfs: online repair of directories")
> Reported-by: Dave Chinner <dgc@xxxxxxxxxx>
> Closes: https://lore.kernel.org/linux-xfs/ap-mIH9nTNkpWq9K@dread/
> Signed-off-by: Javier Tia <javier@xxxxxxxxxxx>
> ---
>  fs/xfs/scrub/dir_repair.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
> index 31a23c5f386a..0a3d02d8f041 100644
> --- a/fs/xfs/scrub/dir_repair.c
> +++ b/fs/xfs/scrub/dir_repair.c
> @@ -1488,7 +1488,7 @@ xrep_dir_swap_prep(
>  			.geo		= sc->mp->m_dir_geo,
>  			.whichfork	= XFS_DATA_FORK,
>  			.trans		= sc->tp,
> -			.total		= 1,
> +			.total		= sc->mp->m_dir_geo->fsbcount,

This is enough to shut up the assertion, but it doesn't fix the
additional problem that the block reservation in sc->tp can also
underrun for this same reason.  I'm testing a fixpatch for both, please
be patient...

--D

>  			.owner		= I_INO(sc->ip),
>  		};
>  
> 
> ---
> base-commit: 0ca15a1a115132dfebeee5447fd6abe46f66d61d
> change-id: 20260908-b4-xrep-dir-total-3c77d0bcff51
> 
> Best regards,
> -- 
> Javier Tia <javier@xxxxxxxxxxx>
>