Re: [PATCH 3/9] libxfs: record a failed buffer write when it fails

[Christoph Hellwig <hch@infradead.org>]

On Thu, Aug 20, 2026 at 10:42:15PM -0700, Chris Wedgwood wrote:
> libxfs_flush_mount() decides whether metadata reached the disk by
> looking at XFS_BUFTARG_LOST_WRITE and XFS_BUFTARG_CORRUPT_WRITE, and its
> comment says a buffer that cannot be written sets them.  It does not.
> The flags are only set from libxfs_buf_prepare_mru(), that is, when a
> still-dirty buffer is later released to the free list.  A write that
> fails during a cache flush leaves the buffer dirty and errored in the
> cache, and cache_flush() discards what libxfs_bflush() returns, so
> nothing records the failure and libxfs_flush_mount() returns success.
> 
> No existing caller can tell: mkfs.xfs and xfs_repair both detect a
> failing write through their own error paths first, so today this is a
> latent contract violation rather than a visible bug.
> 
> It stops being latent with log replay.  Replay flushes the metadata it
> has applied and then retires the log, and the flush result is what says
> the retirement is safe.  Believing a flush that did not happen destroys
> the only remaining copy of that metadata.
> 
> Set the flags where the failure is detected.  Both failure exits, the
> I/O error and the write verifier, go through one helper so the promise
> holds however the write failed.  The stale-buffer exit is left alone: it
> reports a caller bug rather than lost data, and has always done so.
> 
> Measured with an LD_PRELOAD shim that fails pwrite() after a chosen
> number of calls, replaying a log whose recovery needs 558 writes.
> Failing from write 181, which lands in the flush after replay:

Can you wrire this up in xfstests?  Maybe using an environment
variable instead of LD_PRELOAD like some of the other error injection
we do in userspace if that is easier to maintain.