[PATCH 1/2] xfs: quietly ignore deprecated mount options

[PATCH 1/2] xfs: quietly ignore deprecated mount options

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

Apparently we can never deprecate mount options in this project, because
it will invariably turn out that some foolish userspace depends on some
behavior and break.  From Oleksandr Natalenko:

> In v6.18, the attr2 XFS mount option is removed. This may silently
> break system boot if the attr2 option is still present in /etc/fstab
> for rootfs.
>
> Consider Arch Linux that is being set up from scratch with / being
> formatted as XFS. The genfstab command that is used to generate
> /etc/fstab produces something like this by default:
>
> /dev/sda2 on / type xfs (rw,relatime,attr2,discard,inode64,logbufs=8,logbsize=32k,noquota)
>
> Once the system is set up and rebooted, there's no deprecation warning
> seen in the kernel log:
>
> # cat /proc/cmdline
> root=UUID=77b42de2-397e-47ee-a1ef-4dfd430e47e9 rootflags=discard rd.luks.options=discard quiet
>
> # dmesg | grep -i xfs
> [    2.409818] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
> [    2.415341] XFS (sda2): Mounting V5 Filesystem 77b42de2-397e-47ee-a1ef-4dfd430e47e9
> [    2.442546] XFS (sda2): Ending clean mount
>
> Although as per the deprecation intention, it should be there.
>
> Vlastimil (in Cc) suggests this is because xfs_fs_warn_deprecated()
> doesn't produce any warning by design if the XFS FS is set to be
> rootfs and gets remounted read-write during boot. This imposes two
> problems:
>
> 1) a user doesn't see the deprecation warning; and
> 2) with v6.18 kernel, the read-write remount fails because of unknown
>    attr2 option rendering system unusable:
>
> systemd[1]: Switching root.
> systemd-remount-fs[225]: /usr/bin/mount for / exited with exit status 32.
>
> # mount -o rw /
> mount: /: fsconfig() failed: xfs: Unknown parameter 'attr2'.
>
> Thorsten (in Cc) suggested reporting this as a user-visible regression.
>
> From my PoV, although the deprecation is in place for 5 years already,
> it may not be visible enough as the warning is not emitted for rootfs.
> Considering the amount of systems set up with XFS on /, this may
> impose a mass problem for users.
>
> Vlastimil suggested making attr2 option a complete noop instead of
> removing it.

IOWs, the initrd mounts the root fs with (I assume) no mount options,
and mount -a remounts with whatever options are in fstab.  However,
XFS doesn't complain about deprecated mount options during a remount, so
technically speaking we were not warning all users in all combinations
that they were heading for a cliff.

Gotcha!!

Now, how did 'attr2' get slurped up on so many systems?  The old code
would put that in /proc/mounts if the filesystem happened to be in attr2
mode, even if user hadn't mounted with any such option.  IOWs, this is
because someone thought it would be a good idea to advertise system
state via /proc/mounts.

The easy way to fix this is to reintroduce the four mount options but
map them to a no-op option that ignores them, and hope that nobody's
depending on attr2 to appear in /proc/mounts.  (Hint: use the fsgeometry
ioctl).

Lessons learned:

 1. Don't expose system state via /proc/mounts; the only strings that
    ought to be there are options *explicitly* provided by the user.
 2. Never tidy, it's not worth the stress and irritation.

Reported-by: oleksandr@natalenko.name
Reported-by: vbabka@suse.cz
Cc: <stable@vger.kernel.org> # v6.18-rc1
Fixes: b9a176e54162f8 ("xfs: remove deprecated mount options")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 fs/xfs/xfs_super.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index e85a156dc17d16..e1df41991fccc3 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -102,7 +102,7 @@ static const struct constant_table dax_param_enums[] = {
  * Table driven mount option parser.
  */
 enum {
-	Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
+	Opt_quietlyignore, Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
 	Opt_wsync, Opt_noalign, Opt_swalloc, Opt_sunit, Opt_swidth, Opt_nouuid,
 	Opt_grpid, Opt_nogrpid, Opt_bsdgroups, Opt_sysvgroups,
 	Opt_allocsize, Opt_norecovery, Opt_inode64, Opt_inode32,
@@ -115,6 +115,14 @@ enum {
 };
 
 static const struct fs_parameter_spec xfs_fs_parameters[] = {
+	/*
+	 * These mount options were advertised in /proc/mounts even if the
+	 * filesystem had not been mounted with that option.  Quietly ignore
+	 * them to avoid breaking scripts that captured /proc/mounts.
+	 */
+	fsparam_flag("attr",		Opt_quietlyignore),
+	fsparam_flag("noattr2",		Opt_quietlyignore),
+
 	fsparam_u32("logbufs",		Opt_logbufs),
 	fsparam_string("logbsize",	Opt_logbsize),
 	fsparam_string("logdev",	Opt_logdev),
@@ -1408,6 +1416,8 @@ xfs_fs_parse_param(
 		return opt;
 
 	switch (opt) {
+	case Opt_quietlyignore:
+		return 0;
 	case Opt_logbufs:
 		parsing_mp->m_logbufs = result.uint_32;
 		return 0;
@@ -1528,7 +1538,6 @@ xfs_fs_parse_param(
 		xfs_mount_set_dax_mode(parsing_mp, result.uint_32);
 		return 0;
 #endif
-	/* Following mount options will be removed in September 2025 */
 	case Opt_max_open_zones:
 		parsing_mp->m_max_open_zones = result.uint_32;
 		return 0;

[PATCH 2/2] xfs: always warn about deprecated mount options

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

The deprecation of the 'attr2' mount option in 6.18 wasn't entirely
successful because nobody noticed that the kernel never printed a
warning about attr2 being set in fstab if the only xfs filesystem is the
root fs; the initramfs mounts the root fs with no mount options; and the
init scripts only conveyed the fstab options by remounting the root fs.

Fix this by making it complain all the time.

Cc: <stable@vger.kernel.org> # v5.13
Fixes: 92cf7d36384b99 ("xfs: Skip repetitive warnings about mount options")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 fs/xfs/xfs_super.c |   21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index e1df41991fccc3..3517106159327b 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1385,12 +1385,23 @@ xfs_fs_warn_deprecated(
 	uint64_t		flag,
 	bool			value)
 {
-	/* Don't print the warning if reconfiguring and current mount point
-	 * already had the flag set
+	/*
+	 * Always warn about someone passing in a deprecated mount option.
+	 * Previously we wouldn't print the warning if we were reconfiguring
+	 * and current mount point already had the flag set, but that was not
+	 * the right thing to do.
+	 *
+	 * Many distributions mount the root filesystem with no options in the
+	 * initramfs and rely on mount -a to remount the root fs with the
+	 * options in fstab.  However, the old behavior meant that there would
+	 * never be a warning about deprecated mount options for the root fs in
+	 * /etc/fstab.  On a single-fs system, that means no warning at all.
+	 *
+	 * Compounding this problem are distribution scripts that copy
+	 * /proc/mounts to fstab, which means that we can't remove mount
+	 * options unless we're 100% sure they have only ever been advertised
+	 * in /proc/mounts in response to explicitly provided mount options.
 	 */
-	if ((fc->purpose & FS_CONTEXT_FOR_RECONFIGURE) &&
-            !!(XFS_M(fc->root->d_sb)->m_features & flag) == value)
-		return;
 	xfs_warn(fc->s_fs_info, "%s mount option is deprecated.", param->key);
 }
 

Re: [PATCH 1/2] xfs: quietly ignore deprecated mount options

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 2/2] xfs: always warn about deprecated mount options

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 1/2] xfs: quietly ignore deprecated mount options

[Oleksandr Natalenko]

[-- Attachment #1: Type: text/plain, Size: 5795 bytes --]

Hello.

On úterý 14. října 2025 1:32:29, středoevropský letní čas Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> Apparently we can never deprecate mount options in this project, because
> it will invariably turn out that some foolish userspace depends on some
> behavior and break.  From Oleksandr Natalenko:
> 
> > In v6.18, the attr2 XFS mount option is removed. This may silently
> > break system boot if the attr2 option is still present in /etc/fstab
> > for rootfs.
> >
> > Consider Arch Linux that is being set up from scratch with / being
> > formatted as XFS. The genfstab command that is used to generate
> > /etc/fstab produces something like this by default:
> >
> > /dev/sda2 on / type xfs (rw,relatime,attr2,discard,inode64,logbufs=8,logbsize=32k,noquota)
> >
> > Once the system is set up and rebooted, there's no deprecation warning
> > seen in the kernel log:
> >
> > # cat /proc/cmdline
> > root=UUID=77b42de2-397e-47ee-a1ef-4dfd430e47e9 rootflags=discard rd.luks.options=discard quiet
> >
> > # dmesg | grep -i xfs
> > [    2.409818] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
> > [    2.415341] XFS (sda2): Mounting V5 Filesystem 77b42de2-397e-47ee-a1ef-4dfd430e47e9
> > [    2.442546] XFS (sda2): Ending clean mount
> >
> > Although as per the deprecation intention, it should be there.
> >
> > Vlastimil (in Cc) suggests this is because xfs_fs_warn_deprecated()
> > doesn't produce any warning by design if the XFS FS is set to be
> > rootfs and gets remounted read-write during boot. This imposes two
> > problems:
> >
> > 1) a user doesn't see the deprecation warning; and
> > 2) with v6.18 kernel, the read-write remount fails because of unknown
> >    attr2 option rendering system unusable:
> >
> > systemd[1]: Switching root.
> > systemd-remount-fs[225]: /usr/bin/mount for / exited with exit status 32.
> >
> > # mount -o rw /
> > mount: /: fsconfig() failed: xfs: Unknown parameter 'attr2'.
> >
> > Thorsten (in Cc) suggested reporting this as a user-visible regression.
> >
> > From my PoV, although the deprecation is in place for 5 years already,
> > it may not be visible enough as the warning is not emitted for rootfs.
> > Considering the amount of systems set up with XFS on /, this may
> > impose a mass problem for users.
> >
> > Vlastimil suggested making attr2 option a complete noop instead of
> > removing it.
> 
> IOWs, the initrd mounts the root fs with (I assume) no mount options,
> and mount -a remounts with whatever options are in fstab.  However,
> XFS doesn't complain about deprecated mount options during a remount, so
> technically speaking we were not warning all users in all combinations
> that they were heading for a cliff.
> 
> Gotcha!!
> 
> Now, how did 'attr2' get slurped up on so many systems?  The old code
> would put that in /proc/mounts if the filesystem happened to be in attr2
> mode, even if user hadn't mounted with any such option.  IOWs, this is
> because someone thought it would be a good idea to advertise system
> state via /proc/mounts.
> 
> The easy way to fix this is to reintroduce the four mount options but
> map them to a no-op option that ignores them, and hope that nobody's
> depending on attr2 to appear in /proc/mounts.  (Hint: use the fsgeometry
> ioctl).
> 
> Lessons learned:
> 
>  1. Don't expose system state via /proc/mounts; the only strings that
>     ought to be there are options *explicitly* provided by the user.
>  2. Never tidy, it's not worth the stress and irritation.
> 
> Reported-by: oleksandr@natalenko.name
> Reported-by: vbabka@suse.cz
> Cc: <stable@vger.kernel.org> # v6.18-rc1
> Fixes: b9a176e54162f8 ("xfs: remove deprecated mount options")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> ---
>  fs/xfs/xfs_super.c |   13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> index e85a156dc17d16..e1df41991fccc3 100644
> --- a/fs/xfs/xfs_super.c
> +++ b/fs/xfs/xfs_super.c
> @@ -102,7 +102,7 @@ static const struct constant_table dax_param_enums[] = {
>   * Table driven mount option parser.
>   */
>  enum {
> -	Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
> +	Opt_quietlyignore, Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
>  	Opt_wsync, Opt_noalign, Opt_swalloc, Opt_sunit, Opt_swidth, Opt_nouuid,
>  	Opt_grpid, Opt_nogrpid, Opt_bsdgroups, Opt_sysvgroups,
>  	Opt_allocsize, Opt_norecovery, Opt_inode64, Opt_inode32,
> @@ -115,6 +115,14 @@ enum {
>  };
>  
>  static const struct fs_parameter_spec xfs_fs_parameters[] = {
> +	/*
> +	 * These mount options were advertised in /proc/mounts even if the
> +	 * filesystem had not been mounted with that option.  Quietly ignore
> +	 * them to avoid breaking scripts that captured /proc/mounts.
> +	 */
> +	fsparam_flag("attr",		Opt_quietlyignore),

Should have been "attr2" here I suppose.

Thanks.

> +	fsparam_flag("noattr2",		Opt_quietlyignore),
> +
>  	fsparam_u32("logbufs",		Opt_logbufs),
>  	fsparam_string("logbsize",	Opt_logbsize),
>  	fsparam_string("logdev",	Opt_logdev),
> @@ -1408,6 +1416,8 @@ xfs_fs_parse_param(
>  		return opt;
>  
>  	switch (opt) {
> +	case Opt_quietlyignore:
> +		return 0;
>  	case Opt_logbufs:
>  		parsing_mp->m_logbufs = result.uint_32;
>  		return 0;
> @@ -1528,7 +1538,6 @@ xfs_fs_parse_param(
>  		xfs_mount_set_dax_mode(parsing_mp, result.uint_32);
>  		return 0;
>  #endif
> -	/* Following mount options will be removed in September 2025 */
>  	case Opt_max_open_zones:
>  		parsing_mp->m_max_open_zones = result.uint_32;
>  		return 0;
> 

-- 
Oleksandr Natalenko, MSE

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 1/2] xfs: quietly ignore deprecated mount options

[Darrick J. Wong]

On Tue, Oct 14, 2025 at 01:27:40PM +0200, Oleksandr Natalenko wrote:
> Hello.
> 
> On úterý 14. října 2025 1:32:29, středoevropský letní čas Darrick J. Wong wrote:
> > From: Darrick J. Wong <djwong@kernel.org>
> > 
> > Apparently we can never deprecate mount options in this project, because
> > it will invariably turn out that some foolish userspace depends on some
> > behavior and break.  From Oleksandr Natalenko:
> > 
> > > In v6.18, the attr2 XFS mount option is removed. This may silently
> > > break system boot if the attr2 option is still present in /etc/fstab
> > > for rootfs.
> > >
> > > Consider Arch Linux that is being set up from scratch with / being
> > > formatted as XFS. The genfstab command that is used to generate
> > > /etc/fstab produces something like this by default:
> > >
> > > /dev/sda2 on / type xfs (rw,relatime,attr2,discard,inode64,logbufs=8,logbsize=32k,noquota)
> > >
> > > Once the system is set up and rebooted, there's no deprecation warning
> > > seen in the kernel log:
> > >
> > > # cat /proc/cmdline
> > > root=UUID=77b42de2-397e-47ee-a1ef-4dfd430e47e9 rootflags=discard rd.luks.options=discard quiet
> > >
> > > # dmesg | grep -i xfs
> > > [    2.409818] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
> > > [    2.415341] XFS (sda2): Mounting V5 Filesystem 77b42de2-397e-47ee-a1ef-4dfd430e47e9
> > > [    2.442546] XFS (sda2): Ending clean mount
> > >
> > > Although as per the deprecation intention, it should be there.
> > >
> > > Vlastimil (in Cc) suggests this is because xfs_fs_warn_deprecated()
> > > doesn't produce any warning by design if the XFS FS is set to be
> > > rootfs and gets remounted read-write during boot. This imposes two
> > > problems:
> > >
> > > 1) a user doesn't see the deprecation warning; and
> > > 2) with v6.18 kernel, the read-write remount fails because of unknown
> > >    attr2 option rendering system unusable:
> > >
> > > systemd[1]: Switching root.
> > > systemd-remount-fs[225]: /usr/bin/mount for / exited with exit status 32.
> > >
> > > # mount -o rw /
> > > mount: /: fsconfig() failed: xfs: Unknown parameter 'attr2'.
> > >
> > > Thorsten (in Cc) suggested reporting this as a user-visible regression.
> > >
> > > From my PoV, although the deprecation is in place for 5 years already,
> > > it may not be visible enough as the warning is not emitted for rootfs.
> > > Considering the amount of systems set up with XFS on /, this may
> > > impose a mass problem for users.
> > >
> > > Vlastimil suggested making attr2 option a complete noop instead of
> > > removing it.
> > 
> > IOWs, the initrd mounts the root fs with (I assume) no mount options,
> > and mount -a remounts with whatever options are in fstab.  However,
> > XFS doesn't complain about deprecated mount options during a remount, so
> > technically speaking we were not warning all users in all combinations
> > that they were heading for a cliff.
> > 
> > Gotcha!!
> > 
> > Now, how did 'attr2' get slurped up on so many systems?  The old code
> > would put that in /proc/mounts if the filesystem happened to be in attr2
> > mode, even if user hadn't mounted with any such option.  IOWs, this is
> > because someone thought it would be a good idea to advertise system
> > state via /proc/mounts.
> > 
> > The easy way to fix this is to reintroduce the four mount options but
> > map them to a no-op option that ignores them, and hope that nobody's
> > depending on attr2 to appear in /proc/mounts.  (Hint: use the fsgeometry
> > ioctl).
> > 
> > Lessons learned:
> > 
> >  1. Don't expose system state via /proc/mounts; the only strings that
> >     ought to be there are options *explicitly* provided by the user.
> >  2. Never tidy, it's not worth the stress and irritation.
> > 
> > Reported-by: oleksandr@natalenko.name
> > Reported-by: vbabka@suse.cz
> > Cc: <stable@vger.kernel.org> # v6.18-rc1
> > Fixes: b9a176e54162f8 ("xfs: remove deprecated mount options")
> > Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> > ---
> >  fs/xfs/xfs_super.c |   13 +++++++++++--
> >  1 file changed, 11 insertions(+), 2 deletions(-)
> > 
> > diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> > index e85a156dc17d16..e1df41991fccc3 100644
> > --- a/fs/xfs/xfs_super.c
> > +++ b/fs/xfs/xfs_super.c
> > @@ -102,7 +102,7 @@ static const struct constant_table dax_param_enums[] = {
> >   * Table driven mount option parser.
> >   */
> >  enum {
> > -	Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
> > +	Opt_quietlyignore, Opt_logbufs, Opt_logbsize, Opt_logdev, Opt_rtdev,
> >  	Opt_wsync, Opt_noalign, Opt_swalloc, Opt_sunit, Opt_swidth, Opt_nouuid,
> >  	Opt_grpid, Opt_nogrpid, Opt_bsdgroups, Opt_sysvgroups,
> >  	Opt_allocsize, Opt_norecovery, Opt_inode64, Opt_inode32,
> > @@ -115,6 +115,14 @@ enum {
> >  };
> >  
> >  static const struct fs_parameter_spec xfs_fs_parameters[] = {
> > +	/*
> > +	 * These mount options were advertised in /proc/mounts even if the
> > +	 * filesystem had not been mounted with that option.  Quietly ignore
> > +	 * them to avoid breaking scripts that captured /proc/mounts.
> > +	 */
> > +	fsparam_flag("attr",		Opt_quietlyignore),
> 
> Should have been "attr2" here I suppose.

Yeah, sorry about that, will fix for v2.

Maybe I should use fs_param_deprecated here too.

--D

> Thanks.
> 
> > +	fsparam_flag("noattr2",		Opt_quietlyignore),
> > +
> >  	fsparam_u32("logbufs",		Opt_logbufs),
> >  	fsparam_string("logbsize",	Opt_logbsize),
> >  	fsparam_string("logdev",	Opt_logdev),
> > @@ -1408,6 +1416,8 @@ xfs_fs_parse_param(
> >  		return opt;
> >  
> >  	switch (opt) {
> > +	case Opt_quietlyignore:
> > +		return 0;
> >  	case Opt_logbufs:
> >  		parsing_mp->m_logbufs = result.uint_32;
> >  		return 0;
> > @@ -1528,7 +1538,6 @@ xfs_fs_parse_param(
> >  		xfs_mount_set_dax_mode(parsing_mp, result.uint_32);
> >  		return 0;
> >  #endif
> > -	/* Following mount options will be removed in September 2025 */
> >  	case Opt_max_open_zones:
> >  		parsing_mp->m_max_open_zones = result.uint_32;
> >  		return 0;
> > 
> 
> -- 
> Oleksandr Natalenko, MSE

Re: [PATCH 2/2] xfs: always warn about deprecated mount options

[Darrick J. Wong]

On Mon, Oct 13, 2025 at 09:27:56PM -0700, Christoph Hellwig wrote:
> Looks good:
> 
> Reviewed-by: Christoph Hellwig <hch@lst.de>

Thanks for the review!

I will also remove the now unnecessary parameters for v2.

--D