Crashing during unlinking can lead to wrong st_nlink

[pcworld]

When creating a file with 2 links, then unlinking it and crashing during memcpy_to_pmem_nocache in nova_update_alter_entry (<- nova_inplace_update_log_entry <- nova_inplace_update_dentry <- nova_remove_dentry <- nova_unlink), recovering from that crash state results in a single file with st_nlink reported as 2. I am not completely sure whether this is actually a bug or implementation detail. It seems worth investigating whether this can lead to followup bugs, like unlinking the last actually existing file not freeing the inode or similar.

[Andiry]

Can you post the reproduce steps? Thanks.

[iaoing]

Reproduce

https://github.com/NVSL/linux-nova/blob/976a4d1f3d5282863b23aa834e02012167be6ee2/fs/nova/namei.c#L435-L440

Add return 0 after remove the dentry to simulate a crash.

update_dir.tail = 0;
update_dir.alter_tail = 0;
retval = nova_remove_dentry(dentry, 0, &update_dir, epoch_id, false);
if (retval)
    goto out;

# simulate a crash
return 0;

# rebuild after the modification
insmod nova.ko metadata_csum=1 data_csum=1 data_parity=1 dram_struct_csum=1
mount -t NOVA -o init,data_cow,dbgmask=255 /dev/pmem0 /mnt/pmem0
touch /mnt/pmem0/foo
ln /mnt/pmem0/foo /mnt/pmem0/bar
# stat will show both foo and bar have two links
stat /mnt/pmem0/foo
stat /mnt/pmem0/bar
# unlink function will trigger the modification in the source code, simulating a crash
unlink /mnt/pmem0/foo
# store the crash image
cat /dev/pmem0 > image
# umount and remount the crash image
umount /mnt/pmem0
cat image > /dev/pmem0
sudo mount -t NOVA -o data_cow,dbgmask=255 /dev/pmem0 /mnt/pmem0
# stat will show foo is gone, but the link count of bar is still 2
stat /mnt/pmem0/foo
stat /mnt/pmem0/bar

Reason

The removal of the dentry is conducted in-place, before updating the link count. Thus, if a crash occurs after the removal, we cannot see the dentry but the link is outdated.

Fix

Disable the in-place update option for unlink.