linux-kernel - Directory is not persisted after creating 100s of files inside, writing to another file and renaming it if system crashes.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <84c4e713-85d6-42b9-8dcf-0722ed26cb05@gmail.com>
Date: Wed, 3 Dec 2025 14:26:22 +0300
From: Vyacheslav Kovalevsky <slava.kovalevskiy.2014@...il.com>
To: clm@...com, dsterba@...e.com
Cc: linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Directory is not persisted after creating 100s of files inside,
 writing to another file and renaming it if system crashes.

Directory entry is not persisted after creating 100s (hundreds) of files inside, writing to another file (with `O_SYNC` flag) and renaming it if system crashes.

Detailed description
====================

Hello, we have found another issue with btrfs crash behavior.

In short:

1. Create and sync an empty file in root directory.
2. Make new directory in root directory.
3. Open the file with `O_SYNC` flag and write some data (of specific size).
4. Fill directory with specific number of empty files.
5. Rename the previously written file.
6. Sync root directory.

After system crash directory will be missing, although it was synced in the last step.

System info
===========

Linux version 6.18, also tested on 6.14.11.

How to reproduce
================

```
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define BUFFER_LEN 1024 // should be at least ~ 528
#define FILE_N 256      // should be at least ~ 128

int main() {
   int status;
   int file_fd;
   int root_fd;

   int buffer[BUFFER_LEN + 1] = {};
   for (int i = 0; i < BUFFER_LEN; ++i) {
     buffer[i] = i;
   }

   status = creat("file1", S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
   printf("CREAT: %d\n", status);
   close(status);

   // persist `file1`
   sync();

   status = mkdir("dir", S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
   printf("MKDIR: %d\n", status);

   // `O_SYNC` is important
   status = open("file1", O_WRONLY | O_SYNC);
   printf("OPEN: %d\n", status);
   file_fd = status;

   status = write(file_fd, buffer, BUFFER_LEN);
   printf("WRITE: %d\n", status);

   char path[100];
   // fill directory with a lot of empty files
   for (int i = 0; i < FILE_N; ++i) {
     sprintf(path, "dir/%d", i);
     status = creat(path, S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
     close(status);
   }

   status = rename("file1", "file2");
   printf("RENAME: %d\n", status);

   status = open(".", O_RDONLY | O_DIRECTORY);
   printf("OPEN: %d\n", status);
   root_fd = status;

   // persist `dir`
   status = fsync(root_fd);
   printf("FSYNC: %d\n", status);
}
// after the crash `dir` is missing
```

Steps:

1. Create and mount new btrfs file system in default configuration.
2. Change directory to root of the file system and run the compiled test.
3. Cause hard system crash (e.g. QEMU `system_reset` command).
4. Remount file system after crash.
5. Observe that `dir` directory is missing.