systemd: serialize generated initrd fsck device probes

SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec

@@ -20,7 +20,7 @@ Version:        255
 # determine the build information from local checkout
 Version:        %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/')
 %endif
-Release:        33%{?dist}
+Release:        34%{?dist}
 License:        LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -98,6 +98,9 @@ popd
 /boot/efi/EFI/BOOT/%{grubefiname}
 
 %changelog
+* Thu Aug 27 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 255-34
+- Bump release to match systemd spec.
+
 * Mon Jun 29 2026 Kshitiz Godara <kgodara@microsoft.com> - 255-33
 - Bump release to match systemd spec.
 

SPECS/systemd/generator-lock-fsck-device-with-udevadm.patch

@@ -0,0 +1,170 @@
+diff --git a/src/shared/generator.c b/src/shared/generator.c
+index 5626587..4ae3dfa 100644
+--- a/src/shared/generator.c
++++ b/src/shared/generator.c
+@@ -219,6 +219,11 @@ static int write_fsck_sysroot_service(
+         if (r < 0)
+                 return r;
+
++        /* Azure Linux: wrap the fsck invocation in "udevadm lock" so systemd-fsck
++         * holds an exclusive advisory lock on the target device for the duration of
++         * the check. This prevents systemd-udevd from probing filesystem metadata
++         * while fsck is updating it, which can make the device's filesystem
++         * identifiers disappear from udev before the root mount begins. */
+         fprintf(f,
+                 "[Unit]\n"
+                 "Description=File System Check on %1$s\n"
+@@ -233,7 +238,7 @@ static int write_fsck_sysroot_service(
+                 "[Service]\n"
+                 "Type=oneshot\n"
+                 "RemainAfterExit=yes\n"
+-                "ExecStart=" SYSTEMD_FSCK_PATH " %6$s\n"
++                "ExecStart=/usr/bin/udevadm lock --device=%6$s --timeout=180 -- " SYSTEMD_FSCK_PATH " %6$s\n"
+                 "TimeoutSec=infinity\n",
+                 escaped,
+                 unit,
+diff --git a/test/test-fstab-generator/test-12-dev-sdx.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-12-dev-sdx.expected/systemd-fsck-root.service
+index 1473488..c200c27 100644
+--- a/test/test-fstab-generator/test-12-dev-sdx.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-12-dev-sdx.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/sdx1
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx1 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx1
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-13-label.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-13-label.expected/systemd-fsck-root.service
+index 85c1936..bec5e98 100644
+--- a/test/test-fstab-generator/test-13-label.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-13-label.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/disk/by-label/Root
++ExecStart=/usr/bin/udevadm lock --device=/dev/disk/by-label/Root --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/disk/by-label/Root
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-14-uuid.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-14-uuid.expected/systemd-fsck-root.service
+index 1c7eaea..af939ca 100644
+--- a/test/test-fstab-generator/test-14-uuid.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-14-uuid.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/disk/by-uuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7
++ExecStart=/usr/bin/udevadm lock --device=/dev/disk/by-uuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/disk/by-uuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-15-partuuid.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-15-partuuid.expected/systemd-fsck-root.service
+index ab27bfd..2f4aeae 100644
+--- a/test/test-fstab-generator/test-15-partuuid.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-15-partuuid.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/disk/by-partuuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7
++ExecStart=/usr/bin/udevadm lock --device=/dev/disk/by-partuuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/disk/by-partuuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-root.service
+index 1473488..c200c27 100644
+--- a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/sdx1
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx1 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx1
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-usr.service b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-usr.service
+new file mode 100644
+index 0000000..f5ad547
+--- /dev/null
++++ b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/systemd-fsck-usr.service
+@@ -0,0 +1,17 @@
++# Automatically generated by systemd-fstab-generator
++
++[Unit]
++Description=File System Check on /dev/sdx2
++Documentation=man:systemd-fsck-usr.service(8)
++
++DefaultDependencies=no
++BindsTo=dev-sdx2.device
++Conflicts=shutdown.target
++After=local-fs-pre.target dev-sdx2.device
++Before=shutdown.target
++
++[Service]
++Type=oneshot
++RemainAfterExit=yes
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx2 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx2
++TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/sysusr-usr.mount b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/sysusr-usr.mount
+index 63fcb10..8eaad0b 100644
+--- a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/sysusr-usr.mount
++++ b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected/sysusr-usr.mount
+@@ -4,6 +4,8 @@
+ Documentation=man:fstab(5) man:systemd-fstab-generator(8)
+ SourcePath=/etc/fstab
+ Before=initrd-usr-fs.target
++Requires=systemd-fsck-usr.service
++After=systemd-fsck-usr.service
+ After=blockdev@dev-sdx2.target
+
+ [Mount]
+diff --git a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected.sysroot/sysroot-usr.mount b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected.sysroot/sysroot-usr.mount
+index effb6fc..19eac28 100644
+--- a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected.sysroot/sysroot-usr.mount
++++ b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.expected.sysroot/sysroot-usr.mount
+@@ -4,6 +4,8 @@
+ Documentation=man:fstab(5) man:systemd-fstab-generator(8)
+ SourcePath=/etc/fstab
+ Before=local-fs.target
++Requires=systemd-fsck@dev-sdx2.service
++After=systemd-fsck@dev-sdx2.service
+ After=blockdev@dev-sdx2.target
+
+ [Mount]
+diff --git a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.input b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.input
+index 1ba9b06..0403ac5 100644
+--- a/test/test-fstab-generator/test-17-initrd-sysroot.fstab.input
++++ b/test/test-fstab-generator/test-17-initrd-sysroot.fstab.input
+@@ -1,2 +1,2 @@
+ /dev/sdx1 /sysroot auto defaults 0 1
+-/dev/sdx2 /sysroot/usr auto defaults 0 0
++/dev/sdx2 /sysroot/usr auto defaults 0 1
+diff --git a/test/test-fstab-generator/test-18-options.fstab.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-18-options.fstab.expected/systemd-fsck-root.service
+index 1473488..c200c27 100644
+--- a/test/test-fstab-generator/test-18-options.fstab.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-18-options.fstab.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/sdx1
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx1 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx1
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-root.service b/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-root.service
+index 1473488..c200c27 100644
+--- a/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-root.service
++++ b/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-root.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/sdx1
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx1 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx1
+ TimeoutSec=infinity
+diff --git a/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-usr.service b/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-usr.service
+index 8b42177..f8276b8 100644
+--- a/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-usr.service
++++ b/test/test-fstab-generator/test-19-mounts-from-cmdline.expected/systemd-fsck-usr.service
+@@ -13,5 +13,5 @@ Before=shutdown.target
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=/usr/lib/systemd/systemd-fsck /dev/sdx5
++ExecStart=/usr/bin/udevadm lock --device=/dev/sdx5 --timeout=180 -- /usr/lib/systemd/systemd-fsck /dev/sdx5
+ TimeoutSec=infinity

SPECS/systemd/systemd.spec

@@ -50,7 +50,7 @@ Version:        255
 # determine the build information from local checkout
 Version:        %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/')
 %endif
-Release:        33%{?dist}
+Release:        34%{?dist}
 
 # FIXME - hardcode to 'stable' for now as that's what we have in our blobstore
 %global stable 1
@@ -160,6 +160,18 @@ Patch0912:      networkd-address-skip-firewall-init.patch
 Patch0913:      network-also-check-ID_NET_MANAGED_BY-property-on-rec.patch
 Patch0914:      Prevent-corruption-from-stale-alias-state-on-daemon-reload.patch
 
+# Temporary workaround. Remove this patch when the native e2fsprogs
+# whole-disk lock is integrated into Azure Linux:
+# https://lore.kernel.org/linux-ext4/20260824161512.1332649-1-naraghavan@linux.microsoft.com/
+# Do not ship both implementations. The outer udevadm process retains its
+# exclusive lock while waiting for e2fsck; native e2fsck locking would then
+# block on a second independently-opened lock and deadlock boot.
+#
+# Wrap the initrd-only root and /usr fsck units generated by
+# write_fsck_sysroot_service() so systemd-udevd cannot probe the same device
+# while systemd-fsck updates filesystem metadata.
+Patch0915:      generator-lock-fsck-device-with-udevadm.patch
+
 %ifarch %{ix86} x86_64 aarch64
 %global want_bootloader 1
 %endif
@@ -1257,6 +1269,15 @@ rm -f %{name}.lang
 # %autochangelog. So we need to continue manually maintaining the
 # changelog here.
 %changelog
+* Wed Aug 26 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 255-34
+- Add generator-lock-fsck-device-with-udevadm.patch: in the initrd, wrap the
+  ExecStart= of the special systemd-fsck-root.service and systemd-fsck-usr.service
+  units generated by the fstab-generator with "udevadm lock --device=... --timeout=180
+  --", so systemd-fsck holds an exclusive lock on the device it is checking instead of
+  racing systemd-udevd's own probing of the same device node. Static fsck units
+  (systemd-fsck@.service and systemd-fsck-root.service) are untouched; only the
+  generator-synthesized initrd units are affected.
+
 * Mon Jun 29 2026 Kshitiz Godara <kgodara@microsoft.com> - 255-33
 - Skip tests in %%check that require capabilities not available in the build
   chroot (mount-namespace privileges, systemd-detect-virt on PATH, etc.):