linux.git/fs/xfs, branch v7.2

Merge tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

2026-08-06T15:16:40+00:00

Pull xfs fixes from Carlos Maiolino:
 "This contains mostly a collection of bug fixes found by LLM tools"

* tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (34 commits)
  xfs: check v5 superblock features early
  xfs: add a comment to describe xfs_gc_bio.victim_rtg
  xfs: add a separate bio_set for spliting GC writes
  xfs: don't swallow dquot recovery verification errors
  xfs: fix ilock leak on error in xfs_dq_get_next_id
  xfs: don't ignore runtime errors in xrep_iunlink_reload_next
  xfs: set the prev pointer when reinserting an inode on the unlinked list
  xfs: fix another iunlink infinite loop bug in online fsck
  xfs: fix allocated inodes that show up in the unlinked list
  xfs: check xfarray iteration errors when committing unlinked inode lists
  xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
  xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
  xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
  xfs: don't livelock in scrub on a circular unlinked list
  xfs: hoist per-bucket unlinked list check to helper
  xfs: avoid UAF on sc->tempip in xrep_tempfile_create
  xfs: nlink scrub must take IOLOCK before determining ILOCK state
  xfs: don't zap the attr fork on repair when there are queued pptr updates
  xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
  xfs: don't double-lock when deleting a self-referential directory
  ...

xfs: check v5 superblock features early

2026-08-03T08:30:28+00:00

When working on a new features that reuses the existing pad in the
superblock, I noticed that mounting such a file system on an old kernel
logs a rather confusing warning:

    XFS (vdc): Metadir superblock padding fields must be zero.

This is because we only validate the various feature fields in v5
superblocks after the common superblock validation helper is called.

Fix this by calling the feature validation first.

Fixes: eca383fcd63b ("xfs: refactor superblock verifiers")
Cc:  # v4.19
Signed-off-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: add a comment to describe xfs_gc_bio.victim_rtg

2026-08-03T08:24:02+00:00

All other fields have comments describing them, add one for this field
as well.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Damien Le Moal 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: add a separate bio_set for spliting GC writes

2026-08-03T08:24:02+00:00

Allocating the new bio for a split from the same pool as the original
one can deadlock under memory pressure as the origin bio could be the
last one from the mempool.

Add a separate pool for splitting GC write bios to avoid this.

Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection")
Signed-off-by: Christoph Hellwig 
Reviewed-by: Damien Le Moal 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: don't swallow dquot recovery verification errors

2026-08-03T08:21:33+00:00

xlog_recover_dquot_commit_pass2() validates the recovered dquot with
xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps
to out_release.  But out_release unconditionally returns 0, so the
corruption error is discarded: the caller xlog_recover_items_pass2()
sees success, log recovery proceeds as if the dquot were valid, and the
corrupt quota buffer can be written back to disk.

Fixes: 9c235dfc3d3f ("xfs: dquot recovery does not validate the recovered dquot")
Cc: stable@vger.kernel.org # v6.8
Signed-off-by: Long Li 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: fix ilock leak on error in xfs_dq_get_next_id

2026-08-03T08:21:33+00:00

xfs_dq_get_next_id() takes the quota inode ILOCK before calling
xfs_iread_extents().  If xfs_iread_extents() fails, the function returns
immediately without releasing the lock, leaking the quota inode ILOCK.
This can leave the quota inode locked and cause subsequent quota
operations to hang.

Fix this by jumping to a common unlock path on error instead of returning
directly.

Fixes: bda250dbaf39f ("xfs: rewrite xfs_dq_get_next_id using xfs_iext_lookup_extent")
Cc: stable@vger.kernel.org # v4.12
Signed-off-by: Long Li 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: don't ignore runtime errors in xrep_iunlink_reload_next

2026-08-03T08:20:43+00:00

LOLLM complained that this function ignores runtime errors being
returned by xrep_iunlink_store_*.  Rework the function signature so that
we can return runtime errors to abort the repair.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino

xfs: set the prev pointer when reinserting an inode on the unlinked list

2026-08-03T08:20:43+00:00

If we find a rogue free inode and decide to reinsert it into the
unlinked list, we need to set the prev pointer to NULLAGINO so that the
incore list gets updated.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino

xfs: fix another iunlink infinite loop bug in online fsck

2026-08-03T08:20:43+00:00

xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the
incore prev and next unlinked list pointers based on what it finds on
disk and in memory before we move on to relinking the truly lost inodes
back into the unlinked list.  However, it's still vulnerable to infinite
loops that come in via the next_unlinked pointers.

Fix this problem by remembering which inodes we've already seen and
checking new agino pointers against that.  If a bit is already set,
either this is a loop or the inode has nonzero link count.  We'll deal
with the second case in a subsequent patch.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino

xfs: fix allocated inodes that show up in the unlinked list

2026-08-03T08:20:43+00:00

If an allocated inode shows up in the unlinked list, we need to get it
completely off the list.  Set the corrected next/prev pointers such that
the inode will not look like it should be on an unlinked list at all.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino