linux-kernel - Directory is not persisted after writing to the file within directory if system crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com>
Date: Fri, 24 Oct 2025 18:19:05 +0300
From: Vyacheslav Kovalevsky <slava.kovalevskiy.2014@...il.com>
To: clm@...com, dsterba@...e.com
Cc: linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Directory is not persisted after writing to the file within directory
 if system crashes

Under some circumstances, directory entry is not persisted after writing 
to the file inside the directory that was opened with `O_SYNC` flag if 
system crashes.

Detailed description
====================

Hello, we have found another issue with btrfs crash behavior.

In short, empty file is created and synced. Then, a new directory is 
created, old file is opened with `O_SYNC` flag and some data is written. 
After this, a new hard link is created inside the directory and the root 
is `fsync`ed (directory should persist). However, after a crash, the 
directory entry is missing even though data written to the old file was 
persisted.

System info
===========

Linux version 6.18.0-rc2, also tested on 6.14.11.

How to reproduce
================

```
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

int main() {
int status;
int file_fd;
int root_fd;

status = creat("file1", S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
printf("CREAT: %d\n", status);

// persist `file1`
sync();

status = mkdir("dir", S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
printf("MKDIR: %d\n", status);

status = open("file1", O_WRONLY | O_SYNC);
printf("OPEN: %d\n", status);
file_fd = status;

status = write(file_fd, "Test data!", 10);
printf("WRITE: %d\n", status);

status = link("file1", "dir/file2");
printf("LINK: %d\n", status);

status = open(".", O_RDONLY | O_DIRECTORY);
printf("OPEN: %d\n", status);
root_fd = status;

// persist `dir`
status = fsync(root_fd);
printf("FSYNC: %d\n", status);
}
```

Steps:

1. Create and mount new btrfs file system in default configuration.
2. Change directory to root of the file system and run the compiled test.
3. Cause hard system crash (e.g. QEMU `system_reset` command).
4. Remount file system after crash.
5. Observe that `dir` directory is missing.

Notes:

- ext4 does persist `dir` and `dir/file2` even though it was not synced.
- xfs does persist `dir` but does not persist `dir/file2`.

P.S. Want to apologize for formatting in previous report, first time 
using Thunderbird and plain text.