kernel/linux.git/fs/xfs, branch linux-7.2.y

xfs: restore nofs context unconditionally in xfs_trans_roll

2026-08-27T12:35:23+00:00

commit 0241ea5fb0fe86d2a673163b2f5815111aadc7f7 upstream. When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim: CPU0 CPU1 ---- ---- lock(&xfs_nondir_ilock_class); lock(fs_reclaim); lock(&xfs_nondir_ilock_class); lock(fs_reclaim); Fix this by moving xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction. Reported-by: syzbot+59178abfeb0ea3f0ab20@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=59178abfeb0ea3f0ab20 Fixes: a1ca658d649a ("xfs: fix incorrect context handling in xfs_trans_roll") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Yun Zhou Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino Signed-off-by: Greg Kroah-Hartman

xfs: validate attr entry pointer before field access

2026-08-27T12:35:23+00:00

commit b7eea80be25f3334f131d52982b3131aba77b97d upstream. xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access. Fixes: c84760659dcf2 ("xfs: check attribute leaf block structure") Cc: # v5.5 Signed-off-by: Hongling Zeng Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino Signed-off-by: Greg Kroah-Hartman

Merge tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

2026-08-06T15:16:40+00:00

Pull xfs fixes from Carlos Maiolino: "This contains mostly a collection of bug fixes found by LLM tools" * tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (34 commits) xfs: check v5 superblock features early xfs: add a comment to describe xfs_gc_bio.victim_rtg xfs: add a separate bio_set for spliting GC writes xfs: don't swallow dquot recovery verification errors xfs: fix ilock leak on error in xfs_dq_get_next_id xfs: don't ignore runtime errors in xrep_iunlink_reload_next xfs: set the prev pointer when reinserting an inode on the unlinked list xfs: fix another iunlink infinite loop bug in online fsck xfs: fix allocated inodes that show up in the unlinked list xfs: check xfarray iteration errors when committing unlinked inode lists xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair xfs: don't livelock in scrub on a circular unlinked list xfs: hoist per-bucket unlinked list check to helper xfs: avoid UAF on sc->tempip in xrep_tempfile_create xfs: nlink scrub must take IOLOCK before determining ILOCK state xfs: don't zap the attr fork on repair when there are queued pptr updates xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers xfs: don't double-lock when deleting a self-referential directory ...

xfs: check v5 superblock features early

2026-08-03T08:30:28+00:00

When working on a new features that reuses the existing pad in the superblock, I noticed that mounting such a file system on an old kernel logs a rather confusing warning: XFS (vdc): Metadir superblock padding fields must be zero. This is because we only validate the various feature fields in v5 superblocks after the common superblock validation helper is called. Fix this by calling the feature validation first. Fixes: eca383fcd63b ("xfs: refactor superblock verifiers") Cc: # v4.19 Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino

xfs: add a comment to describe xfs_gc_bio.victim_rtg

2026-08-03T08:24:02+00:00

All other fields have comments describing them, add one for this field as well. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino

xfs: add a separate bio_set for spliting GC writes

2026-08-03T08:24:02+00:00

Allocating the new bio for a split from the same pool as the original one can deadlock under memory pressure as the origin bio could be the last one from the mempool. Add a separate pool for splitting GC write bios to avoid this. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino

xfs: don't swallow dquot recovery verification errors

2026-08-03T08:21:33+00:00

xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk. Fixes: 9c235dfc3d3f ("xfs: dquot recovery does not validate the recovered dquot") Cc: stable@vger.kernel.org # v6.8 Signed-off-by: Long Li Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino

xfs: fix ilock leak on error in xfs_dq_get_next_id

2026-08-03T08:21:33+00:00

xfs_dq_get_next_id() takes the quota inode ILOCK before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns immediately without releasing the lock, leaking the quota inode ILOCK. This can leave the quota inode locked and cause subsequent quota operations to hang. Fix this by jumping to a common unlock path on error instead of returning directly. Fixes: bda250dbaf39f ("xfs: rewrite xfs_dq_get_next_id using xfs_iext_lookup_extent") Cc: stable@vger.kernel.org # v4.12 Signed-off-by: Long Li Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino

xfs: don't ignore runtime errors in xrep_iunlink_reload_next

2026-08-03T08:20:43+00:00

LOLLM complained that this function ignores runtime errors being returned by xrep_iunlink_store_*. Rework the function signature so that we can return runtime errors to abort the repair. Cc: stable@vger.kernel.org # v6.10 Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists") Signed-off-by: Darrick J. Wong Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino

xfs: set the prev pointer when reinserting an inode on the unlinked list

2026-08-03T08:20:43+00:00

If we find a rogue free inode and decide to reinsert it into the unlinked list, we need to set the prev pointer to NULLAGINO so that the incore list gets updated. Cc: stable@vger.kernel.org # v6.10 Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino