[PATCHSET 1/2] xfs: bug fixes for 7.0

[PATCHSET 1/2] xfs: bug fixes for 7.0

[Darrick J. Wong]

Hi all,

Bug fixes for 7.0.

If you're going to start using this code, I strongly recommend pulling
from my git trees, which are linked below.

With a bit of luck, this should all go splendidly.
Comments and questions are, as always, welcome.

--D

kernel git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=xfs-fixes-7.0
---
Commits in this patchset:
 * xfs: fix copy-paste error in previous fix
 * xfs: fix xfs_group release bug in xfs_verify_report_losses
 * xfs: fix xfs_group release bug in xfs_verify_report_losses
 * xfs: fix potential pointer access race in xfs_healthmon_get
 * xfs: don't report metadata inodes to fserror
 * xfs: don't report half-built inodes to fserror
---
 fs/xfs/xfs_mount.h          |    2 +-
 fs/xfs/scrub/dir_repair.c   |    2 +-
 fs/xfs/xfs_health.c         |   20 ++++++++++++++++++--
 fs/xfs/xfs_healthmon.c      |   10 ++++++----
 fs/xfs/xfs_icache.c         |    9 ++++++++-
 fs/xfs/xfs_notify_failure.c |    4 ++--
 fs/xfs/xfs_verify_media.c   |    4 ++--
 7 files changed, 38 insertions(+), 13 deletions(-)

[PATCH 3/6] xfs: fix xfs_group release bug in xfs_verify_report_losses

[Darrick J. Wong]

From: Darrick J. Wong <djwong@kernel.org>

Chris Mason reports that his AI tools noticed that we were using
xfs_perag_put and xfs_group_put to release the group reference returned
by xfs_group_next_range.  However, the iterator function returns an
object with an active refcount, which means that we must use the correct
function to release the active refcount, which is _rele.

Cc: <stable@vger.kernel.org> # v6.0
Fixes: 6f643c57d57c56 ("xfs: implement ->notify_failure() for XFS")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 fs/xfs/xfs_notify_failure.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


diff --git a/fs/xfs/xfs_notify_failure.c b/fs/xfs/xfs_notify_failure.c
index 6be19fa1ebe262..64c8afb935c261 100644
--- a/fs/xfs/xfs_notify_failure.c
+++ b/fs/xfs/xfs_notify_failure.c
@@ -304,7 +304,7 @@ xfs_dax_notify_dev_failure(
 
 			error = xfs_alloc_read_agf(pag, tp, 0, &agf_bp);
 			if (error) {
-				xfs_perag_put(pag);
+				xfs_perag_rele(pag);
 				break;
 			}
 
@@ -340,7 +340,7 @@ xfs_dax_notify_dev_failure(
 		if (rtg)
 			xfs_rtgroup_unlock(rtg, XFS_RTGLOCK_RMAP);
 		if (error) {
-			xfs_group_put(xg);
+			xfs_group_rele(xg);
 			break;
 		}
 	}

Re: [PATCH 3/6] xfs: fix xfs_group release bug in xfs_verify_report_losses

[Christoph Hellwig]

On Wed, Feb 18, 2026 at 10:01:30PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> Chris Mason reports that his AI tools noticed that we were using
> xfs_perag_put and xfs_group_put to release the group reference returned
> by xfs_group_next_range.  However, the iterator function returns an
> object with an active refcount, which means that we must use the correct
> function to release the active refcount, which is _rele.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 3/6] xfs: fix xfs_group release bug in xfs_verify_report_losses

[Carlos Maiolino]

On Wed, Feb 18, 2026 at 10:01:30PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> Chris Mason reports that his AI tools noticed that we were using
> xfs_perag_put and xfs_group_put to release the group reference returned
> by xfs_group_next_range.  However, the iterator function returns an
> object with an active refcount, which means that we must use the correct
> function to release the active refcount, which is _rele.

The subject looks a copy/paste from the previous one, ditto for the
description.

The description matches the patch, but the subject doesn't.

If you're going to send me a PR with this series, please fix it. If I'm
pulling this series straight from the list, I'll fix it here.

Other than the description problems, the patch looks fine:

Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>

> 
> Cc: <stable@vger.kernel.org> # v6.0
> Fixes: 6f643c57d57c56 ("xfs: implement ->notify_failure() for XFS")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> ---
>  fs/xfs/xfs_notify_failure.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> 
> diff --git a/fs/xfs/xfs_notify_failure.c b/fs/xfs/xfs_notify_failure.c
> index 6be19fa1ebe262..64c8afb935c261 100644
> --- a/fs/xfs/xfs_notify_failure.c
> +++ b/fs/xfs/xfs_notify_failure.c
> @@ -304,7 +304,7 @@ xfs_dax_notify_dev_failure(
>  
>  			error = xfs_alloc_read_agf(pag, tp, 0, &agf_bp);
>  			if (error) {
> -				xfs_perag_put(pag);
> +				xfs_perag_rele(pag);
>  				break;
>  			}
>  
> @@ -340,7 +340,7 @@ xfs_dax_notify_dev_failure(
>  		if (rtg)
>  			xfs_rtgroup_unlock(rtg, XFS_RTGLOCK_RMAP);
>  		if (error) {
> -			xfs_group_put(xg);
> +			xfs_group_rele(xg);
>  			break;
>  		}
>  	}
> 
> 

Re: [PATCH 3/6] xfs: fix xfs_group release bug in xfs_verify_report_losses

[Darrick J. Wong]

On Thu, Feb 19, 2026 at 02:02:06PM +0100, Carlos Maiolino wrote:
> On Wed, Feb 18, 2026 at 10:01:30PM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <djwong@kernel.org>
> > 
> > Chris Mason reports that his AI tools noticed that we were using
> > xfs_perag_put and xfs_group_put to release the group reference returned
> > by xfs_group_next_range.  However, the iterator function returns an
> > object with an active refcount, which means that we must use the correct
> > function to release the active refcount, which is _rele.
> 
> The subject looks a copy/paste from the previous one, ditto for the
> description.
> 
> The description matches the patch, but the subject doesn't.

Sorry about that.  Yes, the subject should have referenced
xfs_dax_notify_dev_failure.

> If you're going to send me a PR with this series, please fix it. If I'm
> pulling this series straight from the list, I'll fix it here.
> 
> Other than the description problems, the patch looks fine:
> 
> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>

I'll fix it before I send you a PR.

--D

> > 
> > Cc: <stable@vger.kernel.org> # v6.0
> > Fixes: 6f643c57d57c56 ("xfs: implement ->notify_failure() for XFS")
> > Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> > ---
> >  fs/xfs/xfs_notify_failure.c |    4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > 
> > diff --git a/fs/xfs/xfs_notify_failure.c b/fs/xfs/xfs_notify_failure.c
> > index 6be19fa1ebe262..64c8afb935c261 100644
> > --- a/fs/xfs/xfs_notify_failure.c
> > +++ b/fs/xfs/xfs_notify_failure.c
> > @@ -304,7 +304,7 @@ xfs_dax_notify_dev_failure(
> >  
> >  			error = xfs_alloc_read_agf(pag, tp, 0, &agf_bp);
> >  			if (error) {
> > -				xfs_perag_put(pag);
> > +				xfs_perag_rele(pag);
> >  				break;
> >  			}
> >  
> > @@ -340,7 +340,7 @@ xfs_dax_notify_dev_failure(
> >  		if (rtg)
> >  			xfs_rtgroup_unlock(rtg, XFS_RTGLOCK_RMAP);
> >  		if (error) {
> > -			xfs_group_put(xg);
> > +			xfs_group_rele(xg);
> >  			break;
> >  		}
> >  	}
> > 
> > 
>