Re: [PATCH 18/21] xfs: don't try to verify checksums on empty zones

["Darrick J. Wong" <djwong@kernel.org>]

On Thu, Sep 24, 2026 at 11:59:50AM +0200, Christoph Hellwig wrote:
> xfs_scrub can sometimes send XFS_IOC_VERIFY_MEDIA ioctls for ranges
> that have never been written since the last zone reset, which will
> lead to checksum verification failures.

...and pointless work. :)

> Protect against this by checking that the range is valid.  If the report
> flag is set, a verification failure could lead to health reports and
> the file system being marked corrupt, so lock out zone racing reset
> completions for this case as well.
> 
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
>  fs/xfs/xfs_verify_media.c | 44 ++++++++++++++++++++++++++++++++++++---
>  1 file changed, 41 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/xfs/xfs_verify_media.c b/fs/xfs/xfs_verify_media.c
> index 46a19405c9e5..fc739f7ffa4e 100644
> --- a/fs/xfs/xfs_verify_media.c
> +++ b/fs/xfs/xfs_verify_media.c
> @@ -25,6 +25,8 @@
>  #include "xfs_rtcsum.h"
>  #include "xfs_trace.h"
>  #include "xfs_verify_media.h"
> +#include "xfs_zone_alloc.h"
> +#include "xfs_zone_priv.h"
>  
>  #include <linux/fserror.h>
>  
> @@ -288,6 +290,43 @@ xfs_submit_verify_bio(
>  	return 0;
>  }
>  
> +static int
> +xfs_csum_verify_metafile(
> +	struct xfs_mount	*mp,
> +	struct bio		*bio,
> +	struct bvec_iter	*saved_iter,
> +	void			*csum_buf,
> +	xfs_fsblock_t		bno)
> +{
> +	struct xfs_rtgroup	*rtg;
> +	int			error = 0;
> +
> +	rtg = xfs_rtgroup_get(mp, xfs_rtb_to_rgno(mp, bno));
> +	if (!rtg)
> +		return -EFSCORRUPTED;
> +
> +	/*
> +	 * Only validate the checksums for valid data, as data never written
> +	 * will not have valid checksums.  We need to hold the ilock on the rmap
> +	 * inode to prevent freeing of blocks and thus a zone reset to happen
> +	 * underneath us.
> +	 *
> +	 * Note that this still relies on cooperating userspace, as there also
> +	 * can be blocks that were written but never recorded after an unclean
> +	 * shutdown, which this check does not catch.  It purely tries to deal
> +	 * with races vs the previous FSMAP output used by xfs_scrub.

Just a general note -- if the csum update never makes it to disk, then
the remap cannot have been written to disk either.  Therefore, fsmap
will report that as unowned space, and xfs_scrub won't try to
read-verify it, given the xfs_scrub patch you post later to only read rt
blocks for which there are rmap records.

So I think this is only a theoretical concern, right?

The code looks fine to me, so
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

> +	 */
> +	xfs_ilock(rtg_rmap(rtg), XFS_ILOCK_SHARED);
> +	if (!xa_get_mark(&mp->m_groups[XG_TYPE_RTG].xa, rtg_rgno(rtg),
> +			XFS_RTG_FREE)) {
> +		error = xfs_csum_verify(mp, bio, saved_iter, csum_buf, bno,
> +				false);
> +	}
> +	xfs_iunlock(rtg_rmap(rtg), XFS_ILOCK_SHARED);
> +	xfs_rtgroup_put(rtg);
> +	return error;
> +}
> +
>  static int
>  xfs_submit_verify_bio_csum(
>  	struct xfs_mount	*mp,
> @@ -332,9 +371,8 @@ xfs_submit_verify_bio_csum(
>  	if (error)
>  		goto out_buf_rele;
>  
> -	error = xfs_csum_verify(mp, &bio, &saved_iter,
> -			csum_bp->b_addr + xfs_rtb_to_rtcsumoff(mp, bno), bno,
> -			false);
> +	error = xfs_csum_verify_metafile(mp, &bio, &saved_iter,
> +			csum_bp->b_addr + xfs_rtb_to_rtcsumoff(mp, bno), bno);
>  	if (error)
>  		goto out_media_error;
>  
> -- 
> 2.53.0
> 
>