Re: [PATCH 02/14] xfs: online quotacheck must dirty dquot if enforcement adjustments needed

["Darrick J. Wong" <djwong@kernel.org>]

On Sun, Sep 20, 2026 at 11:15:30PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> LOLLM noticed that we have no way to force xchk_commit_dquot to call
> xfs_qm_adjust_dqenforcement if nothing else is wrong with the dquot.
> Therefore, add a new predicate to force the dirty flag if the dquot has
> zero limits and there are default limits; or if the grace period timer
> needs adjusting.
> 
> Cc: <stable@vger.kernel.org> # v6.9
> Fixes: 96ed2ae4a9b06b ("xfs: repair dquots based on live quotacheck results")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> Assisted-by: LOLLM # finding obvious bugs
> ---
>  fs/xfs/scrub/quotacheck_repair.c |   51 ++++++++++++++++++++++++++++++++++++++
>  1 file changed, 51 insertions(+)
> 
> 
> diff --git a/fs/xfs/scrub/quotacheck_repair.c b/fs/xfs/scrub/quotacheck_repair.c
> index 48ee08df302a42..e2208510939f08 100644
> --- a/fs/xfs/scrub/quotacheck_repair.c
> +++ b/fs/xfs/scrub/quotacheck_repair.c
> @@ -39,6 +39,54 @@
>   * dquot is locked.
>   */
>  
> +static bool
> +xqcheck_dqres_force_dirty(
> +	const struct xfs_dquot_res	*res,
> +	const struct xfs_quota_limits	*qlim)
> +{
> +	/* zero limits mean that we should set the default limits */
> +	if (res->softlimit == 0 && qlim->soft != 0)
> +		return true;
> +	if (res->hardlimit == 0 && qlim->hard != 0)
> +		return true;
> +
> +	/* do we need to adjust the timer setting? */
> +	if ((res->softlimit && res->count > res->softlimit) ||
> +	    (res->hardlimit && res->count > res->hardlimit)) {
> +		if (res->timer == 0 && qlim->time != 0)

Shashiko says:

"Does this skip repairing missing grace period timers when the default grace
period is configured to 0?
If a quota usage exceeds its limit but has a missing or corrupt timer
(res->timer == 0) and the default grace period (qlim->time) is 0, this
condition evaluates to false. This causes the repair code to skip dirtying
the dquot, bypassing xfs_qm_adjust_dqenforcement().
When the unfixed dquot is subsequently flushed (e.g., via background
writeback or a log force), xfs_qm_dqflush_check() will find count > softlimit
but timer == 0. This is treated as a fatal inconsistency and triggers
SHUTDOWN_CORRUPT_INCORE, effectively turning a reparable condition into a
denial of service."

Yes, that should just be "if (!res->timer) return true;" since we want
to force xfs_qm_adjust_dqtimers to reset it.  I forgot that !qlim->time
just means "expires immediately", not "expires never".

Will fix in next revision.

--D

> +			return true;
> +	} else {
> +		if (res->timer)
> +			return true;
> +	}
> +
> +	return false;
> +}
> +
> +/* Decide if we need to adjust the dquot limits or timers */
> +static bool
> +xqcheck_dquot_force_dirty(
> +	const struct xfs_dquot	*dq)
> +{
> +	struct xfs_quotainfo	*qi = dq->q_mount->m_quotainfo;
> +	struct xfs_def_quota	*defq;
> +
> +	/* root dquot does not enforce limits */
> +	if (dq->q_id == 0)
> +		return false;
> +
> +	defq = xfs_get_defquota(qi, xfs_dquot_type(dq));
> +
> +	if (xqcheck_dqres_force_dirty(&dq->q_blk, &defq->blk))
> +		return true;
> +	if (xqcheck_dqres_force_dirty(&dq->q_ino, &defq->ino))
> +		return true;
> +	if (xqcheck_dqres_force_dirty(&dq->q_rtb, &defq->rtb))
> +		return true;
> +
> +	return false;
> +}
> +
>  /* Commit new counters to a dquot. */
>  static int
>  xqcheck_commit_dquot(
> @@ -91,6 +139,9 @@ xqcheck_commit_dquot(
>  		dirty = true;
>  	}
>  
> +	if (!dirty && xqcheck_dquot_force_dirty(dq))
> +		dirty = true;
> +
>  	xcdq.flags |= (XQCHECK_DQUOT_REPAIR_SCANNED | XQCHECK_DQUOT_WRITTEN);
>  	error = xfarray_store(counts, dq->q_id, &xcdq);
>  	if (error == -EFBIG) {
> 
>