linux-kernel - Re: [PATCH] ocfs2: fix stale extent map cache during COW operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251011083244.822985-1-kartikey406@gmail.com>
Date: Sat, 11 Oct 2025 14:02:44 +0530
From: Deepanshu Kartikey <kartikey406@...il.com>
To: heming.zhao@...e.com,
	joseph.qi@...ux.alibaba.com,
	mark@...heh.com,
	jlbec@...lplan.org
Cc: ocfs2-devel@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	syzbot+6fdd8fa3380730a4b22c@...kaller.appspotmail.com
Subject: Re: [PATCH] ocfs2: fix stale extent map cache during COW operations

Hi Heming,

Thank you for the detailed analysis and feedback.

After further investigation, I discovered that the ioctl call in the reproducer 
(0x40406f06) is NOT FITRIM as the syzbot comment suggested. Decoding the ioctl 
number shows:
  - Type: 'o' (0x6f)
  - Number: 6
  - This is OCFS2_IOC_MOVE_EXT (defined in fs/ocfs2/ocfs2_ioctl.h:222)

So the actual call path in the reproducer is:
1. copy_file_range() - creates reflinked extent with flags=0x2
2. ioctl(OCFS2_IOC_MOVE_EXT) - calls ocfs2_move_extents() -> 
   __ocfs2_move_extents_range()
3. write() - triggers BUG_ON

Inside __ocfs2_move_extents_range(), the while loop:
  - Calls ocfs2_get_clusters() which caches the extent with flags=0x2
  - Then calls ocfs2_move_extent() -> __ocfs2_move_extent()
  - __ocfs2_move_extent() at line 50 clears the refcount flag on disk:
      replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
  - But the extent cache is not invalidated

This is exactly what my v2 patch fixes by adding ocfs2_extent_map_trunc() 
after the move operation completes.

Thanks for your time!

Best regards,
Deepanshu