Re: [Question] Unlinking original file of bind mounted file.

[Eric Biggers <ebiggers@kernel.org>]

On Fri, Dec 30, 2022 at 08:16:19PM +0900, Yun Levi wrote:
> > No, that's not correct.  Here's how to think about Unix files (not just
> > ext4, going all the way back to the 1970s).  Each inode has a reference
> > count.  All kinds of things hold a reference count to an inode; some of
> > the more common ones are a name in a directory, an open file, a mmap of
> > that open file, passing a file descriptor through a unix socket, etc, etc.
> >
> > Unlink removes a name from a directory.  That causes the reference count
> > to be decreased, but the inode will only be released if that causes the
> > reference count to drop to 0.  If the file is open, or it has multiple
> > names, it won't be removed.
> >
> > mount --bind obviously isn't traditional Unix, but it fits in the same
> > paradigm.  It causes a new reference count to be taken on the inode.
> > So you can remove the original name that was used to create the link,
> > and that causes i_nlink to drop to 0, but the in-memory refcount is
> > still positive, so the inode will not be reused.
> >
> 
> Actually, when the bind mount happens on the some file, it doesn't
> increase the inode->i_count,
> Instead of that, it increases dentry's refcount.
> So, If we do "mount --bind a b"
> it just increases the reference of dentry of a, not i_count of a.

Sure, but the dentry pins the inode.

> So, when rm -f a, it just put the reference of dentry

No, it doesn't change the refcount of the dentry.  The unlink does temporarily
increment, and then decrement, the refcount.  However, there is still another
reference that's held by the bind mount.  For that reason, the dentry's inode is
not released yet; instead, the dentry is just made unavailable to lookups.

> When the unlink on b, finally the dentry is killed and free the inode.

You can't actually do that, because the unlink fails with EBUSY.  And even if
you could, it would be a different dentry (b instead of a).

> Here is What I saw via crash

If you have a reproducer for an actual crash, please provide it.  (And if you do
indeed have an actual crash, please consider that its root cause may be
completely unrelated to the theory that you've described...)

- Eric