[PATCH] xfs: start inodegc after quota initialization

Pedro Demarchi Gomes
2026-04-13T00:50:06Z

When mounting a xfs filesystem with quotas, if an error occurs in xfs_mount
after calling xfs_inodegc_start and before m_quotainfo initialization, the
error path will call xfs_inodegc_flush assuming that m_quotainfo was already
initialized, causing the following error:

[ 82.411853][ T23] ==================================================================
[ 82.412678][ T23] BUG: KASAN: null-ptr-deref in mutex_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:4457 kernel/locking/mutex.c:159 kernel/locking/mutex.c:289)
[ 82.413383][ T23] Write of size 8 at addr 0000000000000030 by task kworker/1:0/23
[ 82.414187][ T23]
[ 82.414450][ T23] CPU: 1 UID: 0 PID: 23 Comm: kworker/1:0 Not tainted 7.0.0-rc5-00051-gbbeb83d3182a #35 PREEMPT(
[ 82.414458][ T23] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 82.414463][ T23] Workqueue: xfs-inodegc/loop0 xfs_inodegc_worker
[ 82.414478][ T23] Call Trace:
[ 82.414481][ T23] <TASK>
[ 82.414484][ T23] dump_stack_lvl (lib/dump_stack.c:122)
[ 82.414494][ T23] print_report (mm/kasan/report.c:487)
[ 82.414518][ T23] kasan_report (mm/kasan/report.c:597)
[ 82.414541][ T23] kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200)
[ 82.414549][ T23] mutex_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:4457 kernel/locking/mutex.c:159 kernel/locking/mutex.c:289)
[ 82.414601][ T23] xfs_qm_dqget_cache_lookup (fs/xfs/xfs_dquot.c:813)
[ 82.414609][ T23] xfs_qm_dqget_inode (fs/xfs/xfs_dquot.c:1017)
[ 82.414678][ T23] xfs_qm_dqattach_locked (fs/xfs/xfs_qm.c:331)
[ 82.414688][ T23] xfs_qm_dqattach (fs/xfs/xfs_qm.c:371)
[ 82.414696][ T23] xfs_inactive (fs/xfs/xfs_inode.c:1453)
[ 82.414733][ T23] xfs_inodegc_worker (fs/xfs/xfs_icache.c:1946 fs/xfs/xfs_icache.c:1992)
[ 82.414743][ T23] process_scheduled_works (kernel/workqueue.c:3281 kernel/workqueue.c:3359)
[ 82.414755][ T23] worker_thread (kernel/workqueue.c:?)
[ 82.414775][ T23] kthread (kernel/kthread.c:437)
[ 82.414787][ T23] ret_from_fork (arch/x86/kernel/process.c:164)
[ 82.414822][ T23] ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
[ 82.414834][ T23] </TASK>

To avoid this, call xfs_inodegc_start after quota initialization.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/all/DDC07F0C-05D2-46B4-9815-E010749FB3DC@gmail.com/
Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes@gmail.com>
---
fs/xfs/xfs_mount.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index ef1ea8a1238c..d6f75ab41337 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1057,7 +1057,6 @@ xfs_mountfs(
xfs_clear_using_logged_xattrs(mp);

/* Enable background inode inactivation workers. */
- xfs_inodegc_start(mp);
xfs_blockgc_start(mp);

if (xfs_has_metadir(mp)) {
@@ -1143,6 +1142,8 @@ xfs_mountfs(
}
}

+ xfs_inodegc_start(mp);
+
/*
* Finish recovering the file system. This part needed to be delayed
* until after the root and real-time bitmap inodes were consistently
--
2.47.3