This is a read-only archive. Find the latest Linux articles, documentation, and answers at the new!

via reference counting

Posted by: Administrator on November 17, 2006 02:22 PM
The directory entry just contains the filename and an inode number. The inode is where the other attributes of the file reside (file size, permissions, owner/group, etc., as in "stat" in the article).

One of the attributes is the inode reference count. All files of any type (regular, directory, socket, pipe, symlink) have a reference count, as indicated by "Links" in the "stat" output. This indicates, as the name implies, how many references there are to that inode at any one moment.

Some operations will increment the reference count, such as hard linking or opening. Many processes can have one inode open (e.g. glibc or other app libraries). Note that symlinking does not increment the ref count, because it references by name/path, not inode.

Other operations decrement the ref count, like closing or using "rm". Remember, "rm" primarily deletes the directory entry, which is itself a reference to the inode.

When the inode reference count reaches zero, then all references to that inode are gone (all file descriptors closed in processes, all directory entries gone), and the filesystem driver releases all the inode's disk blocks for re-use by other files (inodes). Note that the disk blocks are not erased; they are merely marked as available.

By way of example:

create file<nobr> <wbr></nobr>/tmp/test-file, placed in inode 17044

  ->inode 17044 ref count set to 1
create a hard link from<nobr> <wbr></nobr>/tmp/test-file to<nobr> <wbr></nobr>/tmp/test-file-link

  ->inode 17044 ref count incremented to 2
process 549 opens<nobr> <wbr></nobr>/tmp/test-file as file #5

  ->inode 17044 ref count incremented to 3
"rm<nobr> <wbr></nobr>/tmp/test-file-link"

  ->inode 17044 ref count decremented to 2
"rm<nobr> <wbr></nobr>/tmp/test-file"

  ->inode 17044 ref count decremented to 1
<nobr> <wbr></nobr>...(note: this is when this article would come in handy! process 549 still has inode 17044 open)...
process 549 closes file #5

  -> inode 17044 ref count decremented to 0, data blocks marked as "available"

For an example "real world" application of this behavior, check the man page for "tmpfile". This function returns a unique temporary file, opened and ready for use, to be deleted automatically on close. It accomplishes this by creating the file by name (refcnt++), opening it (refcnt++), then deleting the filename (refcnt--) and passing the open file descriptor back to the calling code. The refcnt is 1 on the inode, until the program closes the file descriptor; once this happens, the inode and its data blocks are released.

Sometimes, the reference count to a file is inconsistent with the system state (think "power failed while I was using"); fsck will fix this. Also, not all filesystems accessible to Linux are inode-based (iso9660, vfat), so reference counting is not available as part of the filesystem infrastructure.

Now, if you add journaling (ext3, jfs, xfs, ReiserFS), managing all this gets a lot more complicated...


Return to Bring back deleted files with lsof