xfs: estimate post-merge refcounts correctly

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161676

commit b25d198
Author: Darrick J. Wong <djwong@kernel.org>
Date:   Wed Nov 30 09:25:51 2022 -0800

    xfs: estimate post-merge refcounts correctly

    Upon enabling fsdax + reflink for XFS, xfs/179 began to report refcount
    metadata corruptions after being run.  Specifically, xfs_repair noticed
    single-block refcount records that could be combined but had not been.

    The root cause of this is improper MAXREFCOUNT edge case handling in
    xfs_refcount_merge_extents.  When we're trying to find candidates for a
    refcount btree record merge, we compute the refcount attribute of the
    merged record, but we fail to account for the fact that once a record
    hits rc_refcount == MAXREFCOUNT, it is pinned that way forever.  Hence
    the computed refcount is wrong, and we fail to merge the extents.

    Fix this by adjusting the merge predicates to compute the adjusted
    refcount correctly.

    Fixes: 3172725 ("xfs: adjust refcount of an extent of blocks in refcount btree")
    Signed-off-by: Darrick J. Wong <djwong@kernel.org>
    Reviewed-by: Dave Chinner <dchinner@redhat.com>
    Reviewed-by: Xiao Yang <yangx.jy@fujitsu.com>

Signed-off-by: Bill O'Donnell <bodonnel@redhat.com>

Author: Bill O'Donnell

fs/xfs/libxfs/xfs_refcount.c

@@ -789,6 +789,17 @@ xfs_refc_valid(
 	return rc->rc_startblock != NULLAGBLOCK;
 }
 
+static inline xfs_nlink_t
+xfs_refc_merge_refcount(
+	const struct xfs_refcount_irec	*irec,
+	enum xfs_refc_adjust_op		adjust)
+{
+	/* Once a record hits MAXREFCOUNT, it is pinned there forever */
+	if (irec->rc_refcount == MAXREFCOUNT)
+		return MAXREFCOUNT;
+	return irec->rc_refcount + adjust;
+}
+
 static inline bool
 xfs_refc_want_merge_center(
 	const struct xfs_refcount_irec	*left,
@@ -800,6 +811,7 @@ xfs_refc_want_merge_center(
 	unsigned long long		*ulenp)
 {
 	unsigned long long		ulen = left->rc_blockcount;
+	xfs_nlink_t			new_refcount;
 
 	/*
 	 * To merge with a center record, both shoulder records must be
@@ -815,9 +827,10 @@ xfs_refc_want_merge_center(
 		return false;
 
 	/* The shoulder record refcounts must match the new refcount. */
-	if (left->rc_refcount != cleft->rc_refcount + adjust)
+	new_refcount = xfs_refc_merge_refcount(cleft, adjust);
+	if (left->rc_refcount != new_refcount)
 		return false;
-	if (right->rc_refcount != cleft->rc_refcount + adjust)
+	if (right->rc_refcount != new_refcount)
 		return false;
 
 	/*
@@ -840,6 +853,7 @@ xfs_refc_want_merge_left(
 	enum xfs_refc_adjust_op		adjust)
 {
 	unsigned long long		ulen = left->rc_blockcount;
+	xfs_nlink_t			new_refcount;
 
 	/*
 	 * For a left merge, the left shoulder record must be adjacent to the
@@ -850,7 +864,8 @@ xfs_refc_want_merge_left(
 		return false;
 
 	/* Left shoulder record refcount must match the new refcount. */
-	if (left->rc_refcount != cleft->rc_refcount + adjust)
+	new_refcount = xfs_refc_merge_refcount(cleft, adjust);
+	if (left->rc_refcount != new_refcount)
 		return false;
 
 	/*
@@ -872,6 +887,7 @@ xfs_refc_want_merge_right(
 	enum xfs_refc_adjust_op		adjust)
 {
 	unsigned long long		ulen = right->rc_blockcount;
+	xfs_nlink_t			new_refcount;
 
 	/*
 	 * For a right merge, the right shoulder record must be adjacent to the
@@ -882,7 +898,8 @@ xfs_refc_want_merge_right(
 		return false;
 
 	/* Right shoulder record refcount must match the new refcount. */
-	if (right->rc_refcount != cright->rc_refcount + adjust)
+	new_refcount = xfs_refc_merge_refcount(cright, adjust);
+	if (right->rc_refcount != new_refcount)
 		return false;
 
 	/*