Why Does Disk Space Appear Full After Deleting Files? Understanding Linux VFS

Background

Sometimes disk space appears full even though large free space remains when inspecting individual directories.

Problem reproduction

Running df shows the root filesystem at 100% usage. du -h --max-depth=1 /home reveals only about 10 GB used, leaving a discrepancy.

Root cause

Deleted files may still be held open by running processes, so their space is not released. The lsof command lists such deleted but still‑open files; restarting the offending processes frees the space.

Linux Virtual File System (VFS)

The VFS is the entry point for all file operations, providing an abstraction layer between user‑space libraries and specific file‑system implementations (ext4, NFS, etc.).

Common file model

Superblock object – stores filesystem metadata in memory and on disk.

Inode object – represents a file’s metadata; exists in memory ( inode structure) and on disk.

File object – created when a file is opened; holds the interaction state between a process and the inode.

Dentry object – represents a directory entry; links a name to an inode.

Directory tree construction

Root filesystem is mounted first; other filesystems are mounted as sub‑directories, forming a unified tree.

Soft link vs hard link

A soft link is a regular file containing a pathname; a hard link points directly to the same inode, increasing the inode’s i_nlink count.

File & process management

Each process that opens a file gets its own file object, while the underlying inode may be shared. The kernel uses open() and close() to adjust the inode’s reference count ( i_count) via iget and iput. When i_count reaches zero, the inode can be released.

File & disk management

Deletion is performed via the unlink system call, which removes a directory entry and decrements the inode’s link count. If the link count drops to zero, the disk blocks are freed.

# dtruss rm tmp
...
unlink("tmp\0", 0x0, 0x0) = 0 0

Summary

The key to understanding why disk space may not be reclaimed lies in the separation of file data and its index structures; only when no process holds an open reference can the space be released, and the write‑back caching policy means memory must be flushed before disk blocks are freed.