* [PATCH 01/12] xfs: be extra careful about replacement directory construction
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
@ 2026-09-28 6:16 ` Darrick J. Wong
2026-09-28 6:34 ` Christoph Hellwig
2026-09-28 6:16 ` [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair Darrick J. Wong
` (11 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:16 UTC (permalink / raw)
To: djwong, cem; +Cc: linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
In the directory repair code, we have some debug calls that check that
we never add a duplicate name to (or remove the wrong entry from) the
new directory structure. LOLLM thinks that we should actually be
careful about that all users, not just the developer's system, so let's
do that. We already had ASSERTs in the bailout cases to make problems
more obvious to the developers.
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dir_repair.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 2cfcf1c35679ea..0164335cb5c1be 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -751,9 +751,7 @@ xrep_dir_replay_update(
const struct xrep_dirent *dirent)
{
struct xfs_mount *mp = rd->sc->mp;
-#ifdef DEBUG
xfs_ino_t ino;
-#endif
uint resblks;
int error;
@@ -774,13 +772,12 @@ xrep_dir_replay_update(
* There shouldn't be any in the temporary dir, but we'll
* verify this in debug mode.
*/
-#ifdef DEBUG
error = xchk_dir_lookup(rd->sc, rd->sc->tempip, xname, &ino);
if (error != -ENOENT) {
ASSERT(error != -ENOENT);
+ error = -EIO;
goto out_cancel;
}
-#endif
error = xrep_dir_replay_createname(rd, xname, dirent->ino,
resblks);
@@ -798,10 +795,10 @@ xrep_dir_replay_update(
* entry. There should be a perfect match in the temporary
* dir, but we'll verify this in debug mode.
*/
-#ifdef DEBUG
error = xchk_dir_lookup(rd->sc, rd->sc->tempip, xname, &ino);
if (error) {
ASSERT(error != 0);
+ error = -EIO;
goto out_cancel;
}
if (ino != dirent->ino) {
@@ -809,7 +806,6 @@ xrep_dir_replay_update(
error = -EIO;
goto out_cancel;
}
-#endif
error = xrep_dir_replay_removename(rd, xname, resblks);
if (error)
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH 01/12] xfs: be extra careful about replacement directory construction
2026-09-28 6:16 ` [PATCH 01/12] xfs: be extra careful about replacement directory construction Darrick J. Wong
@ 2026-09-28 6:34 ` Christoph Hellwig
2026-09-29 3:59 ` Darrick J. Wong
0 siblings, 1 reply; 30+ messages in thread
From: Christoph Hellwig @ 2026-09-28 6:34 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: cem, linux-xfs
On Sun, Sep 27, 2026 at 11:16:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
>
> In the directory repair code, we have some debug calls that check that
> we never add a duplicate name to (or remove the wrong entry from) the
> new directory structure. LOLLM thinks that we should actually be
> careful about that all users, not just the developer's system, so let's
> do that. We already had ASSERTs in the bailout cases to make problems
> more obvious to the developers.
Does it also explain why? The code does look obviously ok, but a
rationale why we do extra lookups would be kinda useful..
^ permalink raw reply [flat|nested] 30+ messages in thread
* Re: [PATCH 01/12] xfs: be extra careful about replacement directory construction
2026-09-28 6:34 ` Christoph Hellwig
@ 2026-09-29 3:59 ` Darrick J. Wong
0 siblings, 0 replies; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-29 3:59 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: cem, linux-xfs
On Sun, Sep 27, 2026 at 11:34:42PM -0700, Christoph Hellwig wrote:
> On Sun, Sep 27, 2026 at 11:16:04PM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <djwong@kernel.org>
> >
> > In the directory repair code, we have some debug calls that check that
> > we never add a duplicate name to (or remove the wrong entry from) the
> > new directory structure. LOLLM thinks that we should actually be
> > careful about that all users, not just the developer's system, so let's
> > do that. We already had ASSERTs in the bailout cases to make problems
> > more obvious to the developers.
>
> Does it also explain why? The code does look obviously ok, but a
> rationale why we do extra lookups would be kinda useful..
LOLLM's explanation is that if the lookup is a useful checking point for
the developers then it ought to be enabled for everyone. I thought
that was a little silly, so I have a better justification:
Directory reconstruction has to be done completely correctly. Hopefully
doing so is vanishingly rare, so it's not a performance hot spot.
Therefore, we should actually double-check our work on the new directory
since we can always discard it and report that the repair failed.
(I should put that in the commit message...)
--D
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
2026-09-28 6:16 ` [PATCH 01/12] xfs: be extra careful about replacement directory construction Darrick J. Wong
@ 2026-09-28 6:16 ` Darrick J. Wong
2026-09-28 6:37 ` Christoph Hellwig
2026-09-28 6:16 ` [PATCH 03/12] xfs: abort dirtree repair if the live update hook dies Darrick J. Wong
` (10 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:16 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM complains that we don't do enough bounds checking of the directory
entries in directory blocks when we're looking for errors or trying to
salvage entries. Let's improve that with more detailed checks.
Cc: <stable@vger.kernel.org> # v4.16
Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dir.c | 56 +++++++++++++++++++++++++++++++++++++++++----
fs/xfs/scrub/dir_repair.c | 30 +++++++++++++++++++++++-
2 files changed, 79 insertions(+), 7 deletions(-)
diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index a63eebf39fd496..dd21570378b281 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -340,6 +340,7 @@ xchk_dir_rec(
xfs_dahash_t hash;
struct xfs_dir3_icleaf_hdr hdr;
unsigned int tag;
+ bool foundit = false;
int error;
ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC ||
@@ -390,22 +391,60 @@ xchk_dir_rec(
xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
goto out_relse;
}
- for (;;) {
+ while (iter_off < end) {
struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
+ unsigned int advance;
- if (iter_off >= end) {
+ /* must have freetag */
+ if (iter_off + offsetof(struct xfs_dir2_data_unused, length) >= end) {
xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
goto out_relse;
}
if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
- iter_off += be16_to_cpu(dup->length);
+ if (iter_off + sizeof(*dup) > end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK,
+ rec_bno);
+ goto out_relse;
+ }
+ advance = xfs_dir2_data_unusedsize(
+ be16_to_cpu(dup->length));
+ if (!advance) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK,
+ rec_bno);
+ goto out_relse;
+ }
+
+ iter_off += advance;
continue;
}
- if (dep == dent)
+
+ /* must have namelen */
+ if (iter_off + offsetof(struct xfs_dir2_data_entry, name) >= end) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ goto out_relse;
+ }
+
+ advance = xfs_dir2_data_entsize(mp, dep->namelen);
+ if (!advance) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK,
+ rec_bno);
+ goto out_relse;
+ }
+
+ if (dep == dent) {
+ foundit = true;
break;
- iter_off += xfs_dir2_data_entsize(mp, dep->namelen);
+ }
+
+ iter_off += advance;
+ }
+
+ /* Hash tree must point to the exact dirent */
+ if (!foundit) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ goto out_relse;
}
/* Retrieve the entry, sanity check it, and compare hashes. */
@@ -419,6 +458,13 @@ xchk_dir_rec(
goto out_relse;
}
+ /* Name must not overflow end of block */
+ if ((char *)dent->name + dent->namelen >
+ (char *)bp->b_addr + BBTOB(bp->b_length)) {
+ xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
+ goto out_relse;
+ }
+
/* Does the directory hash match? */
dname.name = dent->name;
dname.len = dent->namelen;
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 0164335cb5c1be..b625cc71266b74 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -489,14 +489,27 @@ xrep_dir_recover_data(
if (xchk_should_terminate(rd->sc, &error))
return error;
+ /* must have freetag */
+ if (offset + offsetof(struct xfs_dir2_data_unused, length) >= end)
+ break;
+
/* Skip unused entries. */
if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
- if (!dup->length)
+
+ if (offset + sizeof(*dup) > end)
break;
- offset += be16_to_cpu(dup->length);
+ advance = xfs_dir2_data_unusedsize(
+ be16_to_cpu(dup->length));
+ if (!advance)
+ break;
+ offset += advance;
continue;
}
+ /* must have namelen */
+ if (offset + offsetof(struct xfs_dir2_data_entry, name) >= end)
+ break;
+
/* Don't walk off the end of the block. */
advance = xfs_dir2_data_entsize(rd->sc->mp, dep->namelen);
if (!advance)
@@ -532,6 +545,19 @@ xrep_dir_recover_sf(
hdr = ifp->if_data;
end = (unsigned char *)ifp->if_data + ifp->if_bytes;
+ /* sf header must be big enough for count/i8count */
+ if (!hdr || ifp->if_bytes < 2)
+ return 0;
+
+ /* and large enough for the parent inumber */
+ if (hdr->i8count) {
+ if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[8]))
+ return 0;
+ } else {
+ if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[4]))
+ return 0;
+ }
+
ino = xfs_dir2_sf_get_parent_ino(hdr);
trace_xrep_dir_salvaged_parent(rd->sc->ip, ino);
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair
2026-09-28 6:16 ` [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair Darrick J. Wong
@ 2026-09-28 6:37 ` Christoph Hellwig
2026-09-29 4:12 ` Darrick J. Wong
0 siblings, 1 reply; 30+ messages in thread
From: Christoph Hellwig @ 2026-09-28 6:37 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: cem, stable, linux-xfs
On Sun, Sep 27, 2026 at 11:16:20PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
>
> LOLLM complains that we don't do enough bounds checking of the directory
> entries in directory blocks when we're looking for errors or trying to
> salvage entries. Let's improve that with more detailed checks.
>
> Cc: <stable@vger.kernel.org> # v4.16
> Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> Assisted-by: LOLLM # finding obvious bugs
> ---
> fs/xfs/scrub/dir.c | 56 +++++++++++++++++++++++++++++++++++++++++----
> fs/xfs/scrub/dir_repair.c | 30 +++++++++++++++++++++++-
> 2 files changed, 79 insertions(+), 7 deletions(-)
>
>
> diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> index a63eebf39fd496..dd21570378b281 100644
> --- a/fs/xfs/scrub/dir.c
> +++ b/fs/xfs/scrub/dir.c
> @@ -340,6 +340,7 @@ xchk_dir_rec(
> xfs_dahash_t hash;
> struct xfs_dir3_icleaf_hdr hdr;
> unsigned int tag;
> + bool foundit = false;
> int error;
>
> ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC ||
> @@ -390,22 +391,60 @@ xchk_dir_rec(
> xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
> goto out_relse;
> }
> - for (;;) {
> + while (iter_off < end) {
Nit: maybe move the iter_off initialization just above this for
clarify?
> struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
> struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
> + unsigned int advance;
>
> - if (iter_off >= end) {
> + /* must have freetag */
> + if (iter_off + offsetof(struct xfs_dir2_data_unused, length) >= end) {
Overly long line.
In general it feels like the inner body would benefit from being
split into a helper for readability given how big it becomes. That
would also ease deduplicating the xchk_fblock_set_corrupt calls.
^ permalink raw reply [flat|nested] 30+ messages in thread* Re: [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair
2026-09-28 6:37 ` Christoph Hellwig
@ 2026-09-29 4:12 ` Darrick J. Wong
2026-10-10 15:46 ` Darrick J. Wong
0 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-29 4:12 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: cem, stable, linux-xfs
On Sun, Sep 27, 2026 at 11:37:37PM -0700, Christoph Hellwig wrote:
> On Sun, Sep 27, 2026 at 11:16:20PM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <djwong@kernel.org>
> >
> > LOLLM complains that we don't do enough bounds checking of the directory
> > entries in directory blocks when we're looking for errors or trying to
> > salvage entries. Let's improve that with more detailed checks.
> >
> > Cc: <stable@vger.kernel.org> # v4.16
> > Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset")
> > Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> > Assisted-by: LOLLM # finding obvious bugs
> > ---
> > fs/xfs/scrub/dir.c | 56 +++++++++++++++++++++++++++++++++++++++++----
> > fs/xfs/scrub/dir_repair.c | 30 +++++++++++++++++++++++-
> > 2 files changed, 79 insertions(+), 7 deletions(-)
> >
> >
> > diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> > index a63eebf39fd496..dd21570378b281 100644
> > --- a/fs/xfs/scrub/dir.c
> > +++ b/fs/xfs/scrub/dir.c
> > @@ -340,6 +340,7 @@ xchk_dir_rec(
> > xfs_dahash_t hash;
> > struct xfs_dir3_icleaf_hdr hdr;
> > unsigned int tag;
> > + bool foundit = false;
> > int error;
> >
> > ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC ||
> > @@ -390,22 +391,60 @@ xchk_dir_rec(
> > xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
> > goto out_relse;
> > }
> > - for (;;) {
> > + while (iter_off < end) {
>
> Nit: maybe move the iter_off initialization just above this for
> clarify?
Ok.
> > struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
> > struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
> > + unsigned int advance;
> >
> > - if (iter_off >= end) {
> > + /* must have freetag */
> > + if (iter_off + offsetof(struct xfs_dir2_data_unused, length) >= end) {
>
> Overly long line.
Will fix these.
/* must have freetag */
advance = offsetof(struct xfs_dir2_data_unused, length);
if (offset + advance >= end)
break;
> In general it feels like the inner body would benefit from being
> split into a helper for readability given how big it becomes.
I really wish C had a way to make it so that you could hoist just the
*dirent walking code* whilst retaining the custom bits of functionality
(each error handling, and finding dirents). I don't know of a good way
to do that in C that doesn't involve cpp.
> That would also ease deduplicating the xchk_fblock_set_corrupt calls.
I prefer to keep those separate because xchk_*_set_corrupt contains a
tracepoint that captures the callsite, so you can use gdb or other tools
to go find the exact line in the source code that set the corruption
flag.
Originally I had a fugly macro that wrapped the exact metadata check so
that we could stringify it and record that directly in the tracepoint
buffer but enough people complained that I morphed it into what's there
now.
--D
^ permalink raw reply [flat|nested] 30+ messages in thread* Re: [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair
2026-09-29 4:12 ` Darrick J. Wong
@ 2026-10-10 15:46 ` Darrick J. Wong
2026-10-12 12:00 ` Christoph Hellwig
0 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-10-10 15:46 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: cem, stable, linux-xfs
On Mon, Sep 28, 2026 at 09:12:22PM -0700, Darrick J. Wong wrote:
> On Sun, Sep 27, 2026 at 11:37:37PM -0700, Christoph Hellwig wrote:
> > On Sun, Sep 27, 2026 at 11:16:20PM -0700, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <djwong@kernel.org>
> > >
> > > LOLLM complains that we don't do enough bounds checking of the directory
> > > entries in directory blocks when we're looking for errors or trying to
> > > salvage entries. Let's improve that with more detailed checks.
> > >
> > > Cc: <stable@vger.kernel.org> # v4.16
> > > Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset")
> > > Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> > > Assisted-by: LOLLM # finding obvious bugs
> > > ---
> > > fs/xfs/scrub/dir.c | 56 +++++++++++++++++++++++++++++++++++++++++----
> > > fs/xfs/scrub/dir_repair.c | 30 +++++++++++++++++++++++-
> > > 2 files changed, 79 insertions(+), 7 deletions(-)
> > >
> > >
> > > diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> > > index a63eebf39fd496..dd21570378b281 100644
> > > --- a/fs/xfs/scrub/dir.c
> > > +++ b/fs/xfs/scrub/dir.c
> > > @@ -340,6 +340,7 @@ xchk_dir_rec(
> > > xfs_dahash_t hash;
> > > struct xfs_dir3_icleaf_hdr hdr;
> > > unsigned int tag;
> > > + bool foundit = false;
> > > int error;
> > >
> > > ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC ||
> > > @@ -390,22 +391,60 @@ xchk_dir_rec(
> > > xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno);
> > > goto out_relse;
> > > }
> > > - for (;;) {
> > > + while (iter_off < end) {
> >
> > Nit: maybe move the iter_off initialization just above this for
> > clarify?
>
> Ok.
>
> > > struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off;
> > > struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off;
> > > + unsigned int advance;
> > >
> > > - if (iter_off >= end) {
> > > + /* must have freetag */
> > > + if (iter_off + offsetof(struct xfs_dir2_data_unused, length) >= end) {
> >
> > Overly long line.
>
> Will fix these.
>
> /* must have freetag */
> advance = offsetof(struct xfs_dir2_data_unused, length);
> if (offset + advance >= end)
> break;
>
> > In general it feels like the inner body would benefit from being
> > split into a helper for readability given how big it becomes.
>
> I really wish C had a way to make it so that you could hoist just the
> *dirent walking code* whilst retaining the custom bits of functionality
> (each error handling, and finding dirents). I don't know of a good way
> to do that in C that doesn't involve cpp.
I think I misinterpreted the feedback here -- I think hch wanted me to
break up the contents of the loop body, not the loop structure itself.
So, having broken out the "process dirent" and "process unused" logic
into smaller helper functions, the loop body remains compact. The
bounds checking doesn't seriously complicate the helpers...
> > That would also ease deduplicating the xchk_fblock_set_corrupt calls.
>
> I prefer to keep those separate because xchk_*_set_corrupt contains a
> tracepoint that captures the callsite, so you can use gdb or other tools
> to go find the exact line in the source code that set the corruption
> flag.
...and I don't have to deal with any of this ^^ rambling.
--D
> Originally I had a fugly macro that wrapped the exact metadata check so
> that we could stringify it and record that directly in the tracepoint
> buffer but enough people complained that I morphed it into what's there
> now.
>
> --D
>
^ permalink raw reply [flat|nested] 30+ messages in thread* Re: [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair
2026-10-10 15:46 ` Darrick J. Wong
@ 2026-10-12 12:00 ` Christoph Hellwig
0 siblings, 0 replies; 30+ messages in thread
From: Christoph Hellwig @ 2026-10-12 12:00 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: Christoph Hellwig, cem, stable, linux-xfs
On Sat, Oct 10, 2026 at 08:46:34AM -0700, Darrick J. Wong wrote:
> > I really wish C had a way to make it so that you could hoist just the
> > *dirent walking code* whilst retaining the custom bits of functionality
> > (each error handling, and finding dirents). I don't know of a good way
> > to do that in C that doesn't involve cpp.
>
> I think I misinterpreted the feedback here -- I think hch wanted me to
> break up the contents of the loop body, not the loop structure itself.
Yes. Sorry for now being clear enough and not responding quickly
enough.
> So, having broken out the "process dirent" and "process unused" logic
> into smaller helper functions, the loop body remains compact. The
> bounds checking doesn't seriously complicate the helpers...
Cool.
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH 03/12] xfs: abort dirtree repair if the live update hook dies
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
2026-09-28 6:16 ` [PATCH 01/12] xfs: be extra careful about replacement directory construction Darrick J. Wong
2026-09-28 6:16 ` [PATCH 02/12] xfs: improve dirent bounds checking in scrub and repair Darrick J. Wong
@ 2026-09-28 6:16 ` Darrick J. Wong
2026-09-28 6:38 ` Christoph Hellwig
2026-09-28 6:16 ` [PATCH 04/12] xfs: bail out of directory tree repairs on error Darrick J. Wong
` (9 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:16 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM notices that if the live update hook for the directory tree repair
code hits an error, it will set dl->aborted and stops working. If the
repair code ever sees that condition, it ought to bail out immediately
instead of continuing with obsolete data.
Cc: <stable@vger.kernel.org> # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dirtree_repair.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 1d1eafcf6eb598..5a5857ee71d82d 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -813,6 +813,11 @@ xrep_dirtree(
*/
mutex_lock(&dl->lock);
do {
+ if (dl->aborted) {
+ error = -EIO;
+ break;
+ }
+
/*
* Decide what we're going to do, then do it. An -ESTALE
* return here means the scan results are invalid and we have
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 04/12] xfs: bail out of directory tree repairs on error
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (2 preceding siblings ...)
2026-09-28 6:16 ` [PATCH 03/12] xfs: abort dirtree repair if the live update hook dies Darrick J. Wong
@ 2026-09-28 6:16 ` Darrick J. Wong
2026-09-28 8:07 ` Christoph Hellwig
2026-09-28 6:17 ` [PATCH 05/12] xfs: fix revalidation of xchk_dquot_iter cached mappings Darrick J. Wong
` (8 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:16 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM complains that we ignore errors returned by
xrep_dirpath_retain_parent and can set the dotdot entry to random stack
garbage. Fix that by passing errors all the way out.
Cc: <stable@vger.kernel.org> # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dirtree_repair.c | 57 ++++++++++++++++++++++++++---------------
1 file changed, 36 insertions(+), 21 deletions(-)
diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 5a5857ee71d82d..b856abb6bbe9e8 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -94,7 +94,7 @@ xrep_dirtree_delete_all_paths(
}
/* Since this is the surviving path, set the dotdot entry to this value. */
-STATIC void
+STATIC int
xrep_dirpath_retain_parent(
struct xchk_dirtree *dl,
struct xchk_dirpath *path)
@@ -104,18 +104,20 @@ xrep_dirpath_retain_parent(
error = xfarray_load(dl->path_steps, path->first_step, &step);
if (error)
- return;
+ return error;
dl->parent_ino = be64_to_cpu(step.pptr_rec.p_ino);
+ return 0;
}
/* Find the one surviving path so we know how to set dotdot. */
-STATIC void
+STATIC int
xrep_dirtree_find_surviving_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
+ int error;
bool foundit = false;
xchk_dirtree_for_each_path(dl, path) {
@@ -124,7 +126,10 @@ xrep_dirtree_find_surviving_path(
case XCHK_DIRPATH_LOOP:
case XCHK_DIRPATH_OK:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -136,16 +141,19 @@ xrep_dirtree_find_surviving_path(
}
ASSERT(oc->suspect + oc->good == 1);
+
+ return 0;
}
/* Delete all paths except for the one good one. */
-STATIC void
+STATIC int
xrep_dirtree_keep_one_good_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
bool foundit = false;
+ int error;
xchk_dirtree_for_each_path(dl, path) {
switch (path->outcome) {
@@ -157,7 +165,10 @@ xrep_dirtree_keep_one_good_path(
break;
case XCHK_DIRPATH_OK:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -172,23 +183,28 @@ xrep_dirtree_keep_one_good_path(
ASSERT(oc->suspect == 0);
ASSERT(oc->good < 2);
+ return 0;
}
/* Delete all paths except for one suspect one. */
-STATIC void
+STATIC int
xrep_dirtree_keep_one_suspect_path(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
{
struct xchk_dirpath *path;
bool foundit = false;
+ int error = 0;
xchk_dirtree_for_each_path(dl, path) {
switch (path->outcome) {
case XCHK_DIRPATH_CORRUPT:
case XCHK_DIRPATH_LOOP:
if (!foundit) {
- xrep_dirpath_retain_parent(dl, path);
+ error = xrep_dirpath_retain_parent(dl, path);
+ if (error)
+ return error;
+
foundit = true;
continue;
}
@@ -206,13 +222,14 @@ xrep_dirtree_keep_one_suspect_path(
ASSERT(oc->suspect == 1);
ASSERT(oc->good == 0);
+ return error;
}
/*
* Figure out what to do with the paths we tried to find. Returns -EDEADLOCK
* if the scan results have become stale.
*/
-STATIC void
+STATIC int
xrep_dirtree_decide_fate(
struct xchk_dirtree *dl,
struct xchk_dirtree_outcomes *oc)
@@ -222,36 +239,32 @@ xrep_dirtree_decide_fate(
/* Parentless directories should not have any paths at all. */
if (xchk_dirtree_parentless(dl)) {
xrep_dirtree_delete_all_paths(dl, oc);
- return;
+ return 0;
}
/* One path is exactly the number of paths we want. */
- if (oc->good + oc->suspect == 1) {
- xrep_dirtree_find_surviving_path(dl, oc);
- return;
- }
+ if (oc->good + oc->suspect == 1)
+ return xrep_dirtree_find_surviving_path(dl, oc);
/* Zero paths means we should reattach the subdir to the orphanage. */
if (oc->good + oc->suspect == 0) {
if (dl->sc->orphanage)
oc->needs_adoption = true;
- return;
+ return 0;
}
/*
* Otherwise, this subdirectory has too many parents. If there's at
* least one good path, keep it and delete the others.
*/
- if (oc->good > 0) {
- xrep_dirtree_keep_one_good_path(dl, oc);
- return;
- }
+ if (oc->good > 0)
+ return xrep_dirtree_keep_one_good_path(dl, oc);
/*
* There are no good paths and there are too many suspect paths.
* Keep the first suspect path and delete the rest.
*/
- xrep_dirtree_keep_one_suspect_path(dl, oc);
+ return xrep_dirtree_keep_one_suspect_path(dl, oc);
}
/*
@@ -824,7 +837,9 @@ xrep_dirtree(
* to walk again.
*/
if (!dl->stale) {
- xrep_dirtree_decide_fate(dl, &oc);
+ error = xrep_dirtree_decide_fate(dl, &oc);
+ if (error)
+ break;
trace_xrep_dirtree_decided_fate(dl, &oc);
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 05/12] xfs: fix revalidation of xchk_dquot_iter cached mappings
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (3 preceding siblings ...)
2026-09-28 6:16 ` [PATCH 04/12] xfs: bail out of directory tree repairs on error Darrick J. Wong
@ 2026-09-28 6:17 ` Darrick J. Wong
2026-09-28 8:08 ` Christoph Hellwig
2026-09-28 6:17 ` [PATCH 06/12] xfs: don't repair fs summary counters with garbage Darrick J. Wong
` (7 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:17 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM noticed that the purpose of xchk_dquot_iter_revalidate_bmap is to
revalidate the quota file mapping after we've (presumably) done
something to the quota file contents. However, the "yes this is valid"
code isn't quite strong enough -- the mapping must cover at least the
block at fileoff, not just end after fileoff. Fix that.
Cc: <stable@vger.kernel.org> # v6.8
Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dqiterate.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/xfs/scrub/dqiterate.c b/fs/xfs/scrub/dqiterate.c
index 079dc4e691a01a..76393c888484ff 100644
--- a/fs/xfs/scrub/dqiterate.c
+++ b/fs/xfs/scrub/dqiterate.c
@@ -58,6 +58,7 @@ xchk_dquot_iter_revalidate_bmap(
* no need to reread the bmbt.
*/
if (cursor->bmap.br_startoff != NULLFILEOFF &&
+ cursor->bmap.br_startoff <= fileoff &&
cursor->if_seq == ifp->if_seq &&
cursor->bmap.br_startoff + cursor->bmap.br_blockcount > fileoff)
return 0;
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 06/12] xfs: don't repair fs summary counters with garbage
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (4 preceding siblings ...)
2026-09-28 6:17 ` [PATCH 05/12] xfs: fix revalidation of xchk_dquot_iter cached mappings Darrick J. Wong
@ 2026-09-28 6:17 ` Darrick J. Wong
2026-09-28 8:08 ` Christoph Hellwig
2026-09-28 6:17 ` [PATCH 07/12] xfs: allow softlimit with no hardlimit in quota scrub Darrick J. Wong
` (6 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:17 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM noticed that if we scan the filesystem and come up with totally
garbage numbers for the summary counters, we don't actually mark the
scan incomplete. Because we don't do this, repair can install the
garbage values into the filesystem, making things worse. Don't do that.
Cc: <stable@vger.kernel.org> # v6.9
Fixes: 4ed080cd7cb077 ("xfs: repair summary counters")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/fscounters.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index cd96393a9e6fcf..b3fb1b4227659d 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -368,8 +368,10 @@ xchk_fscount_aggregate_agcounts(
/* Bail out if the values we compute are totally nonsense. */
if (fsc->icount < fsc->icount_min || fsc->icount > fsc->icount_max ||
fsc->fdblocks > mp->m_sb.sb_dblocks ||
- fsc->ifree > fsc->icount_max)
+ fsc->ifree > fsc->icount_max) {
+ xchk_set_incomplete(sc);
return -EFSCORRUPTED;
+ }
/*
* If ifree > icount then we probably had some perturbation in the
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 07/12] xfs: allow softlimit with no hardlimit in quota scrub
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (5 preceding siblings ...)
2026-09-28 6:17 ` [PATCH 06/12] xfs: don't repair fs summary counters with garbage Darrick J. Wong
@ 2026-09-28 6:17 ` Darrick J. Wong
2026-09-28 8:08 ` Christoph Hellwig
2026-09-28 6:17 ` [PATCH 08/12] xfs: assign an owner to scrub_stats_fops Darrick J. Wong
` (5 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:17 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM observes that the sysadmin can set a user's soft limit to a
nonzero value and the hard limit to zero, so those aren't corruptions.
Cc: <stable@vger.kernel.org> # v4.15
Fixes: c2fc338c87a31f ("xfs: scrub quota information")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/quota.c | 8 ++++----
fs/xfs/scrub/quota_repair.c | 6 +++---
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/xfs/scrub/quota.c b/fs/xfs/scrub/quota.c
index 222812fe202c21..7a1704b0c9d802 100644
--- a/fs/xfs/scrub/quota.c
+++ b/fs/xfs/scrub/quota.c
@@ -182,21 +182,21 @@ xchk_quota_item(
* suspect, which is why we flag it for review.
*
* Complain about corruption if the soft limit is greater than
- * the hard limit.
+ * the hard limit and there's a hard limit set.
*/
if (dq->q_blk.hardlimit > mp->m_sb.sb_dblocks)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_blk.softlimit > dq->q_blk.hardlimit)
+ if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
if (dq->q_ino.hardlimit > M_IGEO(mp)->maxicount)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_ino.softlimit > dq->q_ino.hardlimit)
+ if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
if (dq->q_rtb.hardlimit > mp->m_sb.sb_rblocks)
xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
- if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
+ if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
/* Check the resource counts. */
diff --git a/fs/xfs/scrub/quota_repair.c b/fs/xfs/scrub/quota_repair.c
index dbbeb858c13c4c..0afce258d5d2e6 100644
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -193,17 +193,17 @@ xrep_quota_item(
goto out_unlock_dquot;
/* Check the limits. */
- if (dq->q_blk.softlimit > dq->q_blk.hardlimit) {
+ if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit) {
dq->q_blk.softlimit = dq->q_blk.hardlimit;
dirty = true;
}
- if (dq->q_ino.softlimit > dq->q_ino.hardlimit) {
+ if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit) {
dq->q_ino.softlimit = dq->q_ino.hardlimit;
dirty = true;
}
- if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
+ if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
dq->q_rtb.softlimit = dq->q_rtb.hardlimit;
dirty = true;
}
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 08/12] xfs: assign an owner to scrub_stats_fops
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (6 preceding siblings ...)
2026-09-28 6:17 ` [PATCH 07/12] xfs: allow softlimit with no hardlimit in quota scrub Darrick J. Wong
@ 2026-09-28 6:17 ` Darrick J. Wong
2026-09-28 8:09 ` Christoph Hellwig
2026-09-28 6:18 ` [PATCH 09/12] xfs: fix lost errno returned from xfarray_foliosort Darrick J. Wong
` (4 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:17 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM complains that file_operations structs for debugfs files are
supposed to have an owner set so that the module can't get unloaded if
someone's sitting on a debugfs file long after unmount/rmmod. Fix that.
Cc: <stable@vger.kernel.org> # v6.6
Fixes: d7a74cad8f4513 ("xfs: track usage statistics of online fsck")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/stats.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/xfs/scrub/stats.c b/fs/xfs/scrub/stats.c
index da2a40a91156f4..6934d76cfd156b 100644
--- a/fs/xfs/scrub/stats.c
+++ b/fs/xfs/scrub/stats.c
@@ -301,6 +301,7 @@ xchk_scrub_stats_read(
}
static const struct file_operations scrub_stats_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.read = xchk_scrub_stats_read,
};
@@ -328,6 +329,7 @@ xchk_clear_scrub_stats_write(
}
static const struct file_operations clear_scrub_stats_fops = {
+ .owner = THIS_MODULE,
.open = simple_open,
.write = xchk_clear_scrub_stats_write,
};
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 09/12] xfs: fix lost errno returned from xfarray_foliosort
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (7 preceding siblings ...)
2026-09-28 6:17 ` [PATCH 08/12] xfs: assign an owner to scrub_stats_fops Darrick J. Wong
@ 2026-09-28 6:18 ` Darrick J. Wong
2026-09-28 8:09 ` Christoph Hellwig
2026-09-28 6:18 ` [PATCH 10/12] xfs: fix skipped inode mask handling in iscan Darrick J. Wong
` (3 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:18 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM noticed that we stop the sort early but don't actually pass along
the error code, which could enable repair code to continue running with
an unsorted array. Fix that.
Cc: <stable@vger.kernel.org> # v6.9
Fixes: ee13fc67205b98 ("xfs: convert xfarray_pagesort to deal with large folios")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/xfarray.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/scrub/xfarray.c b/fs/xfs/scrub/xfarray.c
index c94f355607790e..310262c0aa9219 100644
--- a/fs/xfs/scrub/xfarray.c
+++ b/fs/xfs/scrub/xfarray.c
@@ -905,8 +905,10 @@ xfarray_sort(
* problems, we're done.
*/
ret = xfarray_foliosort(si, lo, hi);
- if (ret < 0)
+ if (ret < 0) {
+ error = ret;
goto out_free;
+ }
if (ret == 1) {
si->stack_depth--;
continue;
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 10/12] xfs: fix skipped inode mask handling in iscan
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (8 preceding siblings ...)
2026-09-28 6:18 ` [PATCH 09/12] xfs: fix lost errno returned from xfarray_foliosort Darrick J. Wong
@ 2026-09-28 6:18 ` Darrick J. Wong
2026-09-28 8:10 ` Christoph Hellwig
2026-09-28 6:18 ` [PATCH 11/12] xfs: don't proceed with xattr repair if the live update fails Darrick J. Wong
` (2 subsequent siblings)
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:18 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
xfs_highbit64() returns -1 if none of the bits in its argument are set.
In this particular callsite, a totally zeroed mask means that no inodes
were skipped, so executing the if-body is incorrect. Fix that.
Cc: <stable@vger.kernel.org> # v6.9
Fixes: 82334a79c6eb1c ("xfs: iscan batching should handle unallocated inodes too")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
fs/xfs/scrub/iscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/xfs/scrub/iscan.c b/fs/xfs/scrub/iscan.c
index 03f72ba9e7a3a0..33cfce603b5b0d 100644
--- a/fs/xfs/scrub/iscan.c
+++ b/fs/xfs/scrub/iscan.c
@@ -545,7 +545,7 @@ xchk_iscan_finish_batch(
mutex_lock(&iscan->lock);
- if (iscan->__batch_ino != NULLFSINO) {
+ if (iscan->__batch_ino != NULLFSINO && iscan->__skipped_inomask) {
highest_skipped = iscan->__batch_ino +
xfs_highbit64(iscan->__skipped_inomask);
iscan->__visited_ino = max(iscan->__visited_ino,
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 11/12] xfs: don't proceed with xattr repair if the live update fails
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (9 preceding siblings ...)
2026-09-28 6:18 ` [PATCH 10/12] xfs: fix skipped inode mask handling in iscan Darrick J. Wong
@ 2026-09-28 6:18 ` Darrick J. Wong
2026-09-28 8:10 ` Christoph Hellwig
2026-09-28 6:18 ` [PATCH 12/12] xfs: don't fix the directory tree if " Darrick J. Wong
2026-10-08 13:32 ` [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Carlos Maiolino
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:18 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM observes that we ought to make one last check for failed live
updates before replacing the xattr structure. Let's be cautious here.
Cc: <stable@vger.kernel.org> # v6.10
Fixes: e5d7ce0364d8ee ("xfs: replay unlocked parent pointer updates that accrue during xattr repair")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/attr_repair.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index ac433a5467516d..387ad909e20bb9 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1477,6 +1477,9 @@ xrep_xattr_rebuild_tree(
if (error)
return error;
+ if (rx->live_update_aborted)
+ return -EIO;
+
/*
* Exchange the blocks mapped by the tempfile's attr fork with the file
* being repaired. The old attr blocks will then be attached to the
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 12/12] xfs: don't fix the directory tree if live update fails
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (10 preceding siblings ...)
2026-09-28 6:18 ` [PATCH 11/12] xfs: don't proceed with xattr repair if the live update fails Darrick J. Wong
@ 2026-09-28 6:18 ` Darrick J. Wong
2026-09-28 8:10 ` Christoph Hellwig
2026-10-08 13:32 ` [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Carlos Maiolino
12 siblings, 1 reply; 30+ messages in thread
From: Darrick J. Wong @ 2026-09-28 6:18 UTC (permalink / raw)
To: djwong, cem; +Cc: stable, linux-xfs
From: Darrick J. Wong <djwong@kernel.org>
LOLLM complains that we don't double-check dl->aborted one last time to
before committing repairs to the filesystem. This is important because
the live update handler could have set ->aborted if it encountered a
runtime error.
Cc: <stable@vger.kernel.org> # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
---
fs/xfs/scrub/dirtree_repair.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index b856abb6bbe9e8..717ebbe4f91916 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -440,6 +440,11 @@ xrep_dirtree_unlink(
error = -ESTALE;
goto out_trans_cancel;
}
+ if (dl->aborted) {
+ mutex_unlock(&dl->lock);
+ error = -EIO;
+ goto out_trans_cancel;
+ }
xrep_dirpath_set_outcome(dl, path, XREP_DIRPATH_DELETING);
mutex_unlock(&dl->lock);
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCHSET] xfs: LLM-inspired bug fixes, part 19
2026-09-28 6:15 [PATCHSET] xfs: LLM-inspired bug fixes, part 19 Darrick J. Wong
` (11 preceding siblings ...)
2026-09-28 6:18 ` [PATCH 12/12] xfs: don't fix the directory tree if " Darrick J. Wong
@ 2026-10-08 13:32 ` Carlos Maiolino
12 siblings, 0 replies; 30+ messages in thread
From: Carlos Maiolino @ 2026-10-08 13:32 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: stable, linux-xfs
On Sun, 27 Sep 2026 23:15:58 -0700, Darrick J. Wong wrote:
> Here's a nineteenth batch of xfs fixes resulting from a LLaMma. Mwa
> mwa mwa...
>
> If you're going to start using this code, I strongly recommend pulling
> from my git trees, which are linked below.
>
> With a bit of luck, this should all go splendidly.
> Comments and questions are, as always, welcome.
>
> [...]
Applied to for-next, thanks!
[01/12] xfs: be extra careful about replacement directory construction
(no commit info)
[02/12] xfs: improve dirent bounds checking in scrub and repair
(no commit info)
[03/12] xfs: abort dirtree repair if the live update hook dies
commit: 07732dea4f5d0410e1566b81a58a1154bf9dcb29
[04/12] xfs: bail out of directory tree repairs on error
commit: d83ca4e7cc65dce6a02fd3427cefd174517657a3
[05/12] xfs: fix revalidation of xchk_dquot_iter cached mappings
commit: 6c64d650460b455980a6023d43bc6c8859c1cfd2
[06/12] xfs: don't repair fs summary counters with garbage
commit: 22a8a7501c0146dba4ce99b8256975ffe945125d
[07/12] xfs: allow softlimit with no hardlimit in quota scrub
commit: 342c2e00b3a99099a7088f7b8c8f075670c603a9
[08/12] xfs: assign an owner to scrub_stats_fops
commit: fe67a493c7a76cf75556152af24285a114f69d34
[09/12] xfs: fix lost errno returned from xfarray_foliosort
commit: 8c4f172c246717b1420f138a159ed15c315a58bd
[10/12] xfs: fix skipped inode mask handling in iscan
commit: 63341d4af16fe850716b454fcd18990590d07d97
[11/12] xfs: don't proceed with xattr repair if the live update fails
commit: 833f98b3be45bc7c6ce4c87bdc4892f546ab72ee
[12/12] xfs: don't fix the directory tree if live update fails
commit: c8226f3d1a7eafe472addc232689e9c9a0c36a1c
Best regards,
--
Carlos Maiolino <cem@kernel.org>
^ permalink raw reply [flat|nested] 30+ messages in thread