Daily update · Sep 21–22, 2026
XFS fixes target scrub, repair, and recovery paths
A large batch of XFS bug fixes covers online scrub/repair, realtime metadata, quota, and log recovery.
In brief
This batch of XFS fixes is mostly aimed at online scrub and repair, with additional corrections for quota, log recovery, realtime metadata, and the file-range exchange ioctl. Many are defensive fixes for failure paths and edge cases such as jiffies wrap, memory allocation failures, and NULL inode references. Several commits are marked for stable backports.
Bug fixes
Guard against inode reference failure in parent repair
xrep_findparent_from_dcache now handles igrab returning NULL when looking up the parent inode from the dentry cache during online repair, instead of assuming it always succeeds.
Why it matters: Avoids a possible NULL dereference in the online repair path.
Don't assert on HEALTHY scrub type when new corruption appears
XFS_SCRUB_TYPE_HEALTHY is a synthetic scrub type used by xfs_scrub to tell the kernel a scan found no problems. If the health system records a new corruption just before this request, the old logic could trip an assertion because HEALTHY has no health-group mapping.
Why it matters: Prevents an assertion failure in a race between xfs_scrub and new error records.
Fix attribute-fork block count comparison in inode repair
xrep_inode_blockcounts compared the attribute-fork block count with the data-fork block count, so it could incorrectly validate an inode's attribute fork.
Why it matters: Online repair of inode records now uses the correct block count for the attribute fork.
Release orphanage inode reference if chown fails
If moving a file to the orphanage succeeds but the chown step fails, the extra inode reference was leaked.
Why it matters: Fixes an inode reference leak in online repair failure handling.
Release AGFL earlier during rmapbt repair
rmapbt repair held the AGFL (allocation group free list) locked for the whole scrub transaction after walking it; the patch releases it once the AGFL blocks have been recorded.
Why it matters: Reduces lock hold time during online repair of the reverse-mapping btree.
Use proper jiffies comparison in scrub pacing
xchk_maybe_relax used raw >= to compare jiffies values; jiffies wraps around, so the correct time_after_eq helper is needed.
Why it matters: Avoids scrub pacing mistakes after jiffies wrap.
Validate padding field in commit-range ioctl
xfs_ioc_commit_range did not check the padding field in the ioctl struct.
Why it matters: Tightens the new file-range commit ioctl before it sees wider use.
Skip finish work on file-range exchange dry runs
A dry-run exchange still called xfs_exchange_range_finish, which could strip privileges, flush dirty data, and trim COW (copy-on-write) staging events. The patch exits early on DRY_RUN.
Why it matters: Dry runs now behave like dry runs instead of performing side effects.
Correct block reservations for realtime rmap/refcount recovery
Log recovery used the wrong reservation size for realtime rmap and refcount intent items after a crash.
Why it matters: Avoids incorrect block reservations during recovery of realtime metadata operations.
Fix integer overflow in xbitmap set functions
xbitmap set functions could underflow or overflow when computing left and right pointers, returning wrong values for very large ranges.
Why it matters: Hardens bitmap range handling used by scrub and repair.
Don't flag dir3 block blocks for zero padding
Directory scrub checked for zero padding in both dir3_data and dir3_block formats, but block-format directories don't have that padding field.
Why it matters: Prevents false preen flags on block-format directories.
Correct di_forkoff validation in scrub
The inode fork offset check used the wrong base for the byte count, so it could miss values larger than the literal area.
Why it matters: Inode scrub now validates di_forkoff within the inode's literal area correctly.
Handle NULL cached zone in xfs_get_cached_zone
The cached zone pointer can be NULL after resampling under i_flags_lock; the patch accounts for that.
Why it matters: Avoids a NULL pointer dereference in zone allocation caching.
Refresh realtime quota prealloc limits after default limits
If default realtime block quota limits are installed, the precomputed preallocation watermark limits must be updated too.
Why it matters: Realtime quota preallocation watermarks stay in sync with default rtb limits.
Fix rtgroup repair space estimates
Online repair of the realtime refcount btree didn't include the refcount btree size in its reserved-space estimate.
Why it matters: Avoids underestimating repair space for realtime refcount btree repairs.
Don't cross-reference rmapbt with incomplete bitmaps
If computing space usage bitmaps failed with an out-of-memory error, rmapbt scrub silently dropped the error and cross-referenced with incomplete data.
Why it matters: Scrub now reports an incomplete scrub instead of bogus cross-reference errors.
Don't leak blocks on memory failure during btree repair
A memory allocation failure in xrep_newbt_add_blocks could leak already-allocated blocks and leave online repair unable to back out cleanly. The patch changes the small reservation allocation to a no-fail allocation.
Why it matters: Removes a memory-failure leak and potential filesystem shutdown path in online btree repair.
Don't merge different file I/O error types
The file range health monitor could merge health events with different error types into one record.
Why it matters: Health monitoring keeps different I/O errors distinct.
Fix blockgc group quota scan when user quota isn't enforced
A copy-paste error meant the group-quota prealloc scan failed to set FLAG_GID when only group limits were near, so it might not free preallocations and could hit an unnecessary EDQUOT.
Why it matters: The blockgc background scanner can now free preallocations correctly for group quota enforcement.
Fix unlinked inode bucket recovery
Log recovery of iunlink buckets had several pointer and state bugs that could cause use-after-free, leaks, or unlinked-list loops.
Why it matters: Makes crash recovery of unlinked inode lists safer.
Drop dquot flush lock when buffer can't be found
xfs_qm_flush_one could fail to drop the dquot flush lock if the associated buffer couldn't be found.
Why it matters: Fixes a dquot flush lock leak in quota writeback.
Prevent hidden_space underflow in metafile reservation
xfs_metafile_resv_init could subtract used space from an already-small available count, making hidden_space negative and causing a huge free-block count subtraction.
Why it matters: Avoids free-space accounting corruption when reserving metadata btree file space.
Fix wild memcpy when formatting ondisk rtrefcount btree root
The formatting code copied two sets of keys into a node-block root, but node blocks contain only one set; this over-copies past the source data.
Why it matters: Fixes potential memory corruption when writing realtime refcount btree roots.
Source commits26 entries +
xfs: remove unused xfs_reflink_remap_range declaration
Anuj Gupta · Sep 4, 2026 · 1 files
xfs: guard against igrab failure in xrep_findparent_from_dcache
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: fix attr fork block count checks in xrep_inode_blockcounts
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: release orphanage dir inode if chown fails
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: release AGFL after walking it during rmapbt repair
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: use correct jiffies comparison function in xchk_maybe_relax
Darrick J. Wong · Sep 10, 2026 · 1 files
xfs: check padding field in xfs_ioc_commit_range
Darrick J. Wong · Sep 11, 2026 · 1 files
xfs: don't call xfs_exchange_range_finish for a dry run
Darrick J. Wong · Sep 11, 2026 · 1 files
xfs: use the correct reservations for rtrmap/refcount recovery
Darrick J. Wong · Sep 11, 2026 · 2 files
xfs: fix integer overflows in xbitmap set functions
Darrick J. Wong · Sep 11, 2026 · 1 files
xfs: only flag zero padding for dir3 data blocks, not dir3 block blocks
Darrick J. Wong · Sep 11, 2026 · 1 files
xfs: check di_forkoff correctly in scrub
Darrick J. Wong · Sep 11, 2026 · 1 files
xfs: fix typos and repeated words in comments
Hemanth Selam · Sep 11, 2026 · 17 files
xfs: remove duplicate INO1_WRITTEN check
Jiangshan Yi · Sep 14, 2026 · 1 files
xfs: don't try to get a reference to a NULL oz in xfs_get_cached_zone
Christoph Hellwig · Sep 14, 2026 · 1 files
xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: fix rtgroup repair estimations
Darrick J. Wong · Sep 15, 2026 · 2 files
xfs: don't cross reference rmapbt with bitmaps if they're incomplete
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: don't let memory failures leak blocks and kill repairs
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: don't merge different file IO error types
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: fix blockgc group quota scanning when usrquota isn't enforced
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: fix cursor and pointer handling when recovering iunlink buckets
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: drop dquot flush lock when we can't find a buffer to flush
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: don't let hidden_space go negative in xfs_metafile_resv_init
Darrick J. Wong · Sep 15, 2026 · 1 files
xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
Darrick J. Wong · Sep 15, 2026 · 1 files