diff --git a/.gitignore b/.gitignore index 91febd3..c0e856e 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,5 @@ xfsprogs-3.1.2.tar.gz /xfsprogs-6.6.0.tar.xz /xfsprogs-6.11.0.tar.sign /xfsprogs-6.11.0.tar.xz +/xfsprogs-6.16.0.tar.xz +/xfsprogs-6.16.0.tar.sign diff --git a/for-next-xfs_repair-Bump-link-count-if-longform_dir2_rebuild-.patch b/for-next-xfs_repair-Bump-link-count-if-longform_dir2_rebuild-.patch deleted file mode 100644 index a7092e7..0000000 --- a/for-next-xfs_repair-Bump-link-count-if-longform_dir2_rebuild-.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 454fab69c484c24d8fb76ac3676553a54af381f7 Mon Sep 17 00:00:00 2001 -From: Eric Sandeen -Date: Tue, 15 Apr 2025 13:09:23 -0500 -Subject: [PATCH] xfs_repair: Bump link count if longform_dir2_rebuild yields - shortform dir - -If longform_dir2_rebuild() has so few entries in *hashtab that it results -in a short form directory, bump the link count manually as shortform -directories have no explicit "." entry. - -Without this, repair will end with i.e.: - -resetting inode 131 nlinks from 2 to 1 - -in this case, because it thinks this directory inode only has 1 link -discovered, and then a 2nd repair will fix it: - -resetting inode 131 nlinks from 1 to 2 - -because shortform_dir2_entry_check() explicitly adds the extra ref when -the (newly-created)shortform directory is checked: - - /* - * no '.' entry in shortform dirs, just bump up ref count by 1 - * '..' was already (or will be) accounted for and checked when - * the directory is reached or will be taken care of when the - * directory is moved to orphanage. - */ - add_inode_ref(current_irec, current_ino_offset); - -Avoid this by adding the extra ref if we convert from longform to -shortform. - -Signed-off-by: Eric Sandeen -[aalbersh drop SoB with user.mail as name] -Reviewed-by: Bill O'Donnell -Reviewed-by: Darrick J. Wong -Signed-off-by: Pavel Reichl ---- - repair/phase6.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/repair/phase6.c b/repair/phase6.c -index dbc090a5..8804278a 100644 ---- a/repair/phase6.c -+++ b/repair/phase6.c -@@ -1392,6 +1392,13 @@ _("name create failed in ino %" PRIu64 " (%d)\n"), ino, error); - _("name create failed (%d) during rebuild\n"), error); - } - -+ /* -+ * If we added too few entries to retain longform, add the extra -+ * ref for . as this is now a shortform directory. -+ */ -+ if (ip->i_df.if_format == XFS_DINODE_FMT_LOCAL) -+ add_inode_ref(irec, ino_offset); -+ - return; - - out_bmap_cancel: --- -2.49.0 - diff --git a/for-next-xfs_repair-phase6-scan-longform-entries-before-heade.patch b/for-next-xfs_repair-phase6-scan-longform-entries-before-heade.patch deleted file mode 100644 index 959134d..0000000 --- a/for-next-xfs_repair-phase6-scan-longform-entries-before-heade.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 140fd5b163577bd99e07adcdea7e08a99bccbccd Mon Sep 17 00:00:00 2001 -From: Bill O'Donnell -Date: Tue, 15 Apr 2025 13:48:49 -0500 -Subject: [PATCH] xfs_repair: phase6: scan longform entries before header check - -In longform_dir2_entry_check, if check_dir3_header() fails for v5 -metadata, we immediately go to out_fix: and try to rebuild the -directory via longform_dir2_rebuild. But because we haven't yet -called longform_dir2_entry_check_data, the *hashtab used to rebuild -the directory is empty, which results in all existing entries -getting moved to lost+found, and an empty rebuilt directory. On top -of that, the empty directory is now short form, so its nlinks come -out wrong and this requires another repair run to fix. - -Scan the entries before checking the header, so that we have a -decent chance of properly rebuilding the dir if the header is -corrupt, rather than orphaning all the entries and moving them to -lost+found. - -Suggested-by: Eric Sandeen -Signed-off-by: Bill O'Donnell -[aalbersh updated changelog as suggested by Eric Sandeen] -Reviewed-by: Eric Sandeen -Reviewed-by: Darrick J. Wong -Signed-off-by: Pavel Reichl ---- - repair/phase6.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/repair/phase6.c b/repair/phase6.c -index 8804278a..a67cc0ab 100644 ---- a/repair/phase6.c -+++ b/repair/phase6.c -@@ -2431,6 +2431,11 @@ longform_dir2_entry_check( - continue; - } - -+ /* salvage any dirents that look ok */ -+ longform_dir2_entry_check_data(mp, ip, num_illegal, need_dot, -+ irec, ino_offset, bp, hashtab, -+ &freetab, da_bno, fmt == XFS_DIR2_FMT_BLOCK); -+ - /* check v5 metadata */ - if (xfs_has_crc(mp)) { - error = check_dir3_header(mp, bp, ino); -@@ -2445,9 +2450,6 @@ longform_dir2_entry_check( - } - } - -- longform_dir2_entry_check_data(mp, ip, num_illegal, need_dot, -- irec, ino_offset, bp, hashtab, -- &freetab, da_bno, fmt == XFS_DIR2_FMT_BLOCK); - if (fmt == XFS_DIR2_FMT_BLOCK) - break; - --- -2.49.0 - diff --git a/sources b/sources index 009088d..b9e841c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (xfsprogs-6.11.0.tar.sign) = 51d0c7146f4e5995fb94ffa391daaba7f7b681fec19866147bd2c19cfcb21c2ec1d6b88062af1143695f51f6e1986ef8215011c462e6e96536f3bff94e5e1aa5 -SHA512 (xfsprogs-6.11.0.tar.xz) = 209b479e510e5d5c558430b523bebd90f34b2effeac46f783aad4ec45a9f39998ca1efc67155c54c22e778859968f4b275b0ca6f225603f17ae4cc5c7596a4ca +SHA512 (xfsprogs-6.16.0.tar.xz) = 333ef39f38d0fa46742b7fd28ebc6482e90abb32e58634b3a93aa24f0202c55f4dc32f1b00a9859c6e64efada4d844c3a995a913520cb00d5e1a4f1a83da848d +SHA512 (xfsprogs-6.16.0.tar.sign) = 26e9c923e0ae5ddc3bae434ec4eac9f86b0fb73cb5e692dcb42b19a000f119cf493feb850e4b02fa98b5e03017cb3c78caf9b7788e1e44709c4baac984a0c25c diff --git a/v6.14-xfs_repair-handling-a-block-with-bad-crc-bad-uuid-an.patch b/v6.14-xfs_repair-handling-a-block-with-bad-crc-bad-uuid-an.patch deleted file mode 100644 index fe01b7e..0000000 --- a/v6.14-xfs_repair-handling-a-block-with-bad-crc-bad-uuid-an.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 8cd85addd72f1f6e569bd286f6a44dfce90355f1 Mon Sep 17 00:00:00 2001 -From: Bill O'Donnell -Date: Fri, 21 Mar 2025 17:05:35 -0500 -Subject: [PATCH] xfs_repair: handling a block with bad crc, bad uuid, and bad - magic number needs fixing - -In certain cases, if a block is so messed up that crc, uuid and magic -number are all bad, we need to not only detect in phase3 but fix it -properly in phase6. In the current code, the mechanism doesn't work -in that it only pays attention to one of the parameters. - -Note: in this case, the nlink inode link count drops to 1, but -re-running xfs_repair fixes it back to 2. This is a side effect that -should probably be handled in update_inode_nlinks() with separate patch. -Regardless, running xfs_repair twice, with this patch applied -fixes the issue. Recognize that this patch is a fix for xfs v5. - -Signed-off-by: Bill O'Donnell -Reviewed-by: "Darrick J. Wong" - -v2: remove superfluous needmagic logic -v3: clarify the description -Reviewed-by: Christoph Hellwig -Reviewed-by: Darrick J. Wong -Signed-off-by: Pavel Reichl ---- - repair/phase6.c | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/repair/phase6.c b/repair/phase6.c -index 44b9bfc3..dbc090a5 100644 ---- a/repair/phase6.c -+++ b/repair/phase6.c -@@ -2378,7 +2378,6 @@ longform_dir2_entry_check( - da_bno = (xfs_dablk_t)next_da_bno) { - const struct xfs_buf_ops *ops; - int error; -- struct xfs_dir2_data_hdr *d; - - next_da_bno = da_bno + mp->m_dir_geo->fsbcount - 1; - if (bmap_next_offset(ip, &next_da_bno)) { -@@ -2426,9 +2425,7 @@ longform_dir2_entry_check( - } - - /* check v5 metadata */ -- d = bp->b_addr; -- if (be32_to_cpu(d->magic) == XFS_DIR3_BLOCK_MAGIC || -- be32_to_cpu(d->magic) == XFS_DIR3_DATA_MAGIC) { -+ if (xfs_has_crc(mp)) { - error = check_dir3_header(mp, bp, ino); - if (error) { - fixit++; --- -2.49.0 - diff --git a/v6.16-xfs_scrub_fail-reduce-security-lockdowns-to-avoid-po.patch b/v6.16-xfs_scrub_fail-reduce-security-lockdowns-to-avoid-po.patch new file mode 100644 index 0000000..7c5d9d8 --- /dev/null +++ b/v6.16-xfs_scrub_fail-reduce-security-lockdowns-to-avoid-po.patch @@ -0,0 +1,105 @@ +From 15fd6fc686d5ce7640e46d44f6fa018413ce1b64 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Mon, 13 Oct 2025 16:34:24 -0700 +Subject: [PATCH] xfs_scrub_fail: reduce security lockdowns to avoid postfix + problems + +Iustin Pop reports that the xfs_scrub_fail service fails to email +problem reports on Debian when postfix is installed. This is apparently +due to several factors: + +1. postfix's sendmail wrapper calling postdrop directly, +2. postdrop requiring the ability to write to the postdrop group, +3. lockdown preventing the xfs_scrub_fail@ service to have postdrop in + the supplemental group list or the ability to run setgid programs + +Item (3) could be solved by adding the whole service to the postdrop +group via SupplementalGroups=, but that will fail if postfix is not +installed and hence there is no postdrop group. + +It could also be solved by forcing msmtp to be installed, bind mounting +msmtp into the service container, and injecting a config file that +instructs msmtp to connect to port 25, but that in turn isn't compatible +with systems not configured to allow an smtp server to listen on ::1. + +So we'll go with the less restrictive approach that e2scrub_fail@ does, +which is to say that we just turn off all the sandboxing. :( :( + +Reported-by: iustin@debian.org +Cc: linux-xfs@vger.kernel.org # v6.10.0 +Fixes: 9042fcc08eed6a ("xfs_scrub_fail: tighten up the security on the background systemd service") +Signed-off-by: Darrick J. Wong +Reviewed-by: Andrey Albershteyn +Signed-off-by: Pavel Reichl +--- + scrub/xfs_scrub_fail@.service.in | 57 ++------------------------------ + 1 file changed, 3 insertions(+), 54 deletions(-) + +diff --git a/scrub/xfs_scrub_fail@.service.in b/scrub/xfs_scrub_fail@.service.in +index 16077888..1e205768 100644 +--- a/scrub/xfs_scrub_fail@.service.in ++++ b/scrub/xfs_scrub_fail@.service.in +@@ -19,57 +19,6 @@ SupplementaryGroups=systemd-journal + # can control resource usage. + Slice=system-xfs_scrub.slice + +-# No realtime scheduling +-RestrictRealtime=true +- +-# Make the entire filesystem readonly and /home inaccessible. +-ProtectSystem=full +-ProtectHome=yes +-PrivateTmp=true +-RestrictSUIDSGID=true +- +-# Emailing reports requires network access, but not the ability to change the +-# hostname. +-ProtectHostname=true +- +-# Don't let the program mess with the kernel configuration at all +-ProtectKernelLogs=true +-ProtectKernelModules=true +-ProtectKernelTunables=true +-ProtectControlGroups=true +-ProtectProc=invisible +-RestrictNamespaces=true +- +-# Can't hide /proc because journalctl needs it to find various pieces of log +-# information +-#ProcSubset=pid +- +-# Only allow the default personality Linux +-LockPersonality=true +- +-# No writable memory pages +-MemoryDenyWriteExecute=true +- +-# Don't let our mounts leak out to the host +-PrivateMounts=true +- +-# Restrict system calls to the native arch and only enough to get things going +-SystemCallArchitectures=native +-SystemCallFilter=@system-service +-SystemCallFilter=~@privileged +-SystemCallFilter=~@resources +-SystemCallFilter=~@mount +- +-# xfs_scrub needs these privileges to run, and no others +-CapabilityBoundingSet= +-NoNewPrivileges=true +- +-# Failure reporting shouldn't create world-readable files +-UMask=0077 +- +-# Clean up any IPC objects when this unit stops +-RemoveIPC=true +- +-# No access to hardware device files +-PrivateDevices=true +-ProtectClock=true ++# No further restrictions because some installations may have MTAs such as ++# postfix, which require the ability to run setgid programs and other ++# foolishness. +-- +2.51.0 + diff --git a/v6.17-mkfs-fix-copy-paste-error-in-calculate_rtgroup_geome.patch b/v6.17-mkfs-fix-copy-paste-error-in-calculate_rtgroup_geome.patch new file mode 100644 index 0000000..dc47b80 --- /dev/null +++ b/v6.17-mkfs-fix-copy-paste-error-in-calculate_rtgroup_geome.patch @@ -0,0 +1,34 @@ +From bb52ff815e546a8970f22927e12a05717f6780eb Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Sat, 11 Oct 2025 11:34:04 -0700 +Subject: [PATCH] mkfs: fix copy-paste error in calculate_rtgroup_geometry + +Fix this copy-paste error -- we should calculate the rt volume +concurrency either if the user gave us an explicit option, or if they +didn't but the rt volume is an SSD. + +Cc: linux-xfs@vger.kernel.org # v6.13.0 +Fixes: 34738ff0ee80de ("mkfs: allow sizing realtime allocation groups for concurrency") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Pavel Reichl +--- + mkfs/xfs_mkfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mkfs/xfs_mkfs.c b/mkfs/xfs_mkfs.c +index 0511f174..bc6a28b6 100644 +--- a/mkfs/xfs_mkfs.c ++++ b/mkfs/xfs_mkfs.c +@@ -4506,7 +4506,7 @@ _("rgsize (%s) not a multiple of fs blk size (%d)\n"), + cfg->rgsize = cfg->rtblocks; + cfg->rgcount = 0; + } else if (cli->rtvol_concurrency > 0 || +- (cli->data_concurrency == -1 && rtdev_is_solidstate(xi))) { ++ (cli->rtvol_concurrency == -1 && rtdev_is_solidstate(xi))) { + calc_concurrency_rtgroup_geometry(cfg, cli, xi); + } else if (is_power_of_2(cfg->rtextblocks)) { + cfg->rgsize = calc_rgsize_extsize_power(cfg); +-- +2.51.0 + diff --git a/v6.17-xfs-do-not-propagate-ENODATA-disk-errors-into-xattr-.patch b/v6.17-xfs-do-not-propagate-ENODATA-disk-errors-into-xattr-.patch new file mode 100644 index 0000000..466f16f --- /dev/null +++ b/v6.17-xfs-do-not-propagate-ENODATA-disk-errors-into-xattr-.patch @@ -0,0 +1,87 @@ +From 059eef174487133bec609752b6deb3b9db5e64bb Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Mon, 6 Oct 2025 14:40:19 +0200 +Subject: [PATCH] xfs: do not propagate ENODATA disk errors into xattr code + +Source kernel commit: ae668cd567a6a7622bc813ee0bb61c42bed61ba7 + +ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; +namely, that the requested attribute name could not be found. + +However, a medium error from disk may also return ENODATA. At best, +this medium error may escape to userspace as "attribute not found" +when in fact it's an IO (disk) error. + +At worst, we may oops in xfs_attr_leaf_get() when we do: + +error = xfs_attr_leaf_hasname(args, &bp); +if (error == -ENOATTR) { +xfs_trans_brelse(args->trans, bp); +return error; +} + +because an ENODATA/ENOATTR error from disk leaves us with a null bp, +and the xfs_trans_brelse will then null-deref it. + +As discussed on the list, we really need to modify the lower level +IO functions to trap all disk errors and ensure that we don't let +unique errors like this leak up into higher xfs functions - many +like this should be remapped to EIO. + +However, this patch directly addresses a reported bug in the xattr +code, and should be safe to backport to stable kernels. A larger-scope +patch to handle more unique errors at lower levels can follow later. + +(Note, prior to 07120f1abdff we did not oops, but we did return the +wrong error code to userspace.) + +Signed-off-by: Eric Sandeen +Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") +Reviewed-by: Darrick J. Wong +Signed-off-by: Carlos Maiolino +Signed-off-by: Andrey Albershteyn +Reviewed-by: "Darrick J. Wong" +Signed-off-by: Pavel Reichl +--- + libxfs/xfs_attr_remote.c | 7 +++++++ + libxfs/xfs_da_btree.c | 6 ++++++ + 2 files changed, 13 insertions(+) + +diff --git a/libxfs/xfs_attr_remote.c b/libxfs/xfs_attr_remote.c +index a048aa5f..82217baf 100644 +--- a/libxfs/xfs_attr_remote.c ++++ b/libxfs/xfs_attr_remote.c +@@ -434,6 +434,13 @@ xfs_attr_rmtval_get( + 0, &bp, &xfs_attr3_rmt_buf_ops); + if (xfs_metadata_is_sick(error)) + xfs_dirattr_mark_sick(args->dp, XFS_ATTR_FORK); ++ /* ++ * ENODATA from disk implies a disk medium failure; ++ * ENODATA for xattrs means attribute not found, so ++ * disambiguate that here. ++ */ ++ if (error == -ENODATA) ++ error = -EIO; + if (error) + return error; + +diff --git a/libxfs/xfs_da_btree.c b/libxfs/xfs_da_btree.c +index 38f345a9..af3fcdf5 100644 +--- a/libxfs/xfs_da_btree.c ++++ b/libxfs/xfs_da_btree.c +@@ -2829,6 +2829,12 @@ xfs_da_read_buf( + &bp, ops); + if (xfs_metadata_is_sick(error)) + xfs_dirattr_mark_sick(dp, whichfork); ++ /* ++ * ENODATA from disk implies a disk medium failure; ENODATA for ++ * xattrs means attribute not found, so disambiguate that here. ++ */ ++ if (error == -ENODATA && whichfork == XFS_ATTR_FORK) ++ error = -EIO; + if (error) + goto out_free; + +-- +2.51.0 + diff --git a/xfsprogs.spec b/xfsprogs.spec index 42dbf5b..9caacca 100644 --- a/xfsprogs.spec +++ b/xfsprogs.spec @@ -1,7 +1,7 @@ Summary: Utilities for managing the XFS filesystem Name: xfsprogs -Version: 6.11.0 -Release: 2%{?dist} +Version: 6.16.0 +Release: 1%{?dist} License: GPL-1.0-or-later AND LGPL-2.1-or-later URL: https://xfs.wiki.kernel.org Source0: http://kernel.org/pub/linux/utils/fs/xfs/xfsprogs/%{name}-%{version}.tar.xz @@ -11,6 +11,7 @@ Source3: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/46A7E BuildRequires: make BuildRequires: gcc +BuildRequires: g++ BuildRequires: libtool, gettext, libattr-devel, libuuid-devel BuildRequires: libedit-devel, libblkid-devel >= 2.17-0.1.git5e51568 Buildrequires: libicu-devel >= 4.6, systemd @@ -30,9 +31,9 @@ Provides: /usr/sbin/fsck.xfs Provides: /usr/sbin/mkfs.xfs %endif -Patch0: v6.14-xfs_repair-handling-a-block-with-bad-crc-bad-uuid-an.patch -Patch1: for-next-xfs_repair-Bump-link-count-if-longform_dir2_rebuild-.patch -Patch2: for-next-xfs_repair-phase6-scan-longform-entries-before-heade.patch +Patch0: v6.17-mkfs-fix-copy-paste-error-in-calculate_rtgroup_geome.patch +Patch1: v6.17-xfs-do-not-propagate-ENODATA-disk-errors-into-xattr-.patch +Patch2: v6.16-xfs_scrub_fail-reduce-security-lockdowns-to-avoid-po.patch %description A set of commands to use the XFS filesystem, including mkfs.xfs. @@ -144,6 +145,10 @@ rm -rf $RPM_BUILD_ROOT/%{_datadir}/doc/xfsprogs/ %{_libdir}/*.so %changelog +* Thu Oct 23 2025 Pavel Reichl - 6.16.0-1 +- Rebase to upstream version v6.16 +- Related: RHEL-120641 + * Tue May 20 2025 Pavel Reichl - 6.11.0-2 - xfs unrepairable filesystem if directory block not junked in phase 3 - Related: RHEL-89682