systemd: share whole-disk locking with filesystem checks

[Pawel Winogrodzki (PawelWMS)]

Alternative implementation

This draft is an alternative to #18653, not a stacked change. Both proposals add systemd-owned whole-disk serialization around filesystem checks; this version addresses review feedback by sharing the lock mechanics with the udev worker. Do not merge both implementations.

What

• Generalize the shared lock_whole_block_device() helper to operate on the caller's sd_device object.
• Retain a device-number wrapper for the existing systemd-makefs caller.
• Route the udev worker through the shared helper while preserving its nonblocking LOCK_SH|LOCK_NB lock and retry behavior.
• Route systemd-fsck through the same helper with a blocking LOCK_EX lock.
• Release the fsck lock immediately after the child process is reaped.
• Keep systemd and systemd-boot-signed releases synchronized at 255-35.

Why

The root filesystem check can update ext4 metadata while systemd-udevd probes the same disk. If udev observes an inconsistent superblock write, filesystem identification can temporarily fail and boot can lose the device link required by the generated root mount.

The udev worker already coordinates probing with a nonblocking shared whole-disk lock. Using one shared helper for both udev and systemd-fsck keeps device resolution, open, identity revalidation, close-on-exec, and BSD lock acquisition consistent while preserving each caller's distinct lock mode.

Relationship to #18653

#18653 implements the same serialization with a private helper in systemd-fsck. This alternative moves common lock mechanics into blockdev-util and uses them from both call sites. It also closes the parent lock descriptor immediately after the fsck child exits rather than at the end of status handling.

Both systemd-owned variants are mutually exclusive with native e2fsprogs whole-disk locking. A child that independently opens and waits for an exclusive lock already retained by its parent would deadlock.

Risk

• Filesystem checks for partitions on one disk serialize behind a blocking exclusive lock.
• A process that retains a whole-disk lock indefinitely can block a filesystem check because existing fsck units have no timeout.
• The shared helper signature changes for internal callers; all in-tree callers are updated in this patch.
• Device disappearance and replacement remain guarded by opening the original sd_device object and revalidating its identity.

Verification

• Final head: c5f5f713e9ddec176b741e3cd1b181cbb83109e3 (signed).
• Generated the patch from pristine systemd-stable v255 sources and applied it with GNU patch --dry-run -p1 without fuzz or offsets.
• Passed repository manifest, package metadata, source-signature, spec-entanglement, duplicate-SRPM, license, static, and merge-conflict checks.
• Built systemd packages successfully on x86_64 and aarch64; the exact systemd package test passed on both architectures.
• The only failing package test is unrelated dasel on both architectures; it fails identically to systemd: lock disks while running filesystem checks #18653 while systemd builds and tests pass.
• Installed the complete seven-package baseline set, including systemd-rpm-macros, at 255-35 in one RPM transaction on a fresh Azure Linux 3 VM running kernel 6.6.143.1-1.azl3.
• Verified that the RPM transaction regenerated initramfs without a manual dracut step.
• Verified identical host/initramfs systemd-fsck SHA-256: 950eec9a899282ac646efcf3d7320df5ae9b238a456ca4f9cece43402fe3819d.
• Rebooted to a new boot ID; root and boot filesystem checks completed, system state reached running, no units failed, and emergency.target remained inactive.
• Captured managed Boot Diagnostics serial output showing successful filesystem checks and multi-user.target.
• Completed an independent implementation review and resolved its device-identity and exact lock-lifetime findings before commit.