linux-kernel - Re: [PATCH] ocfs2: fix stale extent map cache during COW operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7eb9af90-9ed0-43ec-ba8c-fb78a57ea099@suse.com>
Date: Sat, 11 Oct 2025 20:27:50 +0800
From: Heming Zhao <heming.zhao@...e.com>
To: Deepanshu Kartikey <kartikey406@...il.com>, joseph.qi@...ux.alibaba.com,
 mark@...heh.com, jlbec@...lplan.org
Cc: ocfs2-devel@...ts.linux.dev, linux-kernel@...r.kernel.org,
 syzbot+6fdd8fa3380730a4b22c@...kaller.appspotmail.com
Subject: Re: [PATCH] ocfs2: fix stale extent map cache during COW operations

Hi Deepanshu,

Good catch! With following explanation, your patch looks good to me.

Thanks,
Heming

On 10/11/25 16:32, Deepanshu Kartikey wrote:
> Hi Heming,
> 
> Thank you for the detailed analysis and feedback.
> 
> After further investigation, I discovered that the ioctl call in the reproducer
> (0x40406f06) is NOT FITRIM as the syzbot comment suggested. Decoding the ioctl
> number shows:
>    - Type: 'o' (0x6f)
>    - Number: 6
>    - This is OCFS2_IOC_MOVE_EXT (defined in fs/ocfs2/ocfs2_ioctl.h:222)
> 
> So the actual call path in the reproducer is:
> 1. copy_file_range() - creates reflinked extent with flags=0x2
> 2. ioctl(OCFS2_IOC_MOVE_EXT) - calls ocfs2_move_extents() ->
>     __ocfs2_move_extents_range()
> 3. write() - triggers BUG_ON
> 
> Inside __ocfs2_move_extents_range(), the while loop:
>    - Calls ocfs2_get_clusters() which caches the extent with flags=0x2
>    - Then calls ocfs2_move_extent() -> __ocfs2_move_extent()
>    - __ocfs2_move_extent() at line 50 clears the refcount flag on disk:
>        replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
>    - But the extent cache is not invalidated
> 
> This is exactly what my v2 patch fixes by adding ocfs2_extent_map_trunc()
> after the move operation completes.
> 
> Thanks for your time!
> 
> Best regards,
> Deepanshu