linux-kernel - Re: [PATCH RESEND 0/1] ocfs2: fix reflink preserve cleanup issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <w6hmwb53opubufe77iqvwdcevkggyljujzzjltd3q5s4s4u6k5@ucowivn3qufh>
Date: Tue, 20 Jan 2026 22:57:52 +0800
From: Heming Zhao <heming.zhao@...e.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: joseph.qi@...ux.alibaba.com, mark@...heh.com, jlbec@...lplan.org, 
	ocfs2-devel@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND 0/1] ocfs2: fix reflink preserve cleanup issue

On Mon, Jan 19, 2026 at 03:53:53PM -0800, Andrew Morton wrote:
> On Thu, 18 Dec 2025 22:42:12 +0800 Heming Zhao <heming.zhao@...e.com> wrote:
> 
> > ping...
> > 
> 
> yes please ;)  Some review input would be reassuring, thanks.
> 
> btw, I forgot to ask: what are the worst-case userspace-visible runtime
> effects of this bug?

The worst-case scenario was fixed in commit c06c303832ec ('ocfs2: fix xattr array
entry __counted_by error'). It resolved an out-of-bounds (OOB) issue that could
have caused the kernel to crash.

In patch commit log, there are two issues:
1> the 'last' pointer should be shifted by one unit after cleanup
   an array entry.
2> current code logic doesn't cleanup the first entry when xh_count is 1.

The following points should be noted:

Regarding <1>: after commit c06c303832ec, the last pointer doesn't shift. The
code always clears the last array element.

Regarding <2>: Since the existing code correctly updates new_xh->xh_count, the
xattrs can still be displayed correctly (shown as empty) even if the first entry
is not cleared, as the logic relies on the count.

> 
> IOW, is a -stable backport desirable?

Yes

- Heming
> 
> 
> From: Heming Zhao <heming.zhao@...e.com>
> Subject: ocfs2: fix reflink preserve cleanup issue
> Date: Wed, 10 Dec 2025 09:57:24 +0800
> 
> commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error")
> doesn't handle all cases and the cleanup job for preserved xattr entries
> still has bug:
> - the 'last' pointer should be shifted by one unit after cleanup
>   an array entry.
> - current code logic doesn't cleanup the first entry when xh_count is 1.
> 
> Note, commit c06c303832ec is also a bug fix for 0fe9b66c65f3.
> 
> Link: https://lkml.kernel.org/r/20251210015725.8409-2-heming.zhao@suse.com
> Fixes: 0fe9b66c65f3 ("ocfs2: Add preserve to reflink.")
> Signed-off-by: Heming Zhao <heming.zhao@...e.com>
> Cc: Mark Fasheh <mark@...heh.com>
> Cc: Joel Becker <jlbec@...lplan.org>
> Cc: Junxiao Bi <junxiao.bi@...cle.com>
> Cc: Joseph Qi <jiangqi903@...il.com>
> Cc: Changwei Ge <gechangwei@...e.cn>
> Cc: Jun Piao <piaojun@...wei.com>
> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
> ---
> 
>  fs/ocfs2/xattr.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> --- a/fs/ocfs2/xattr.c~ocfs2-fix-reflink-preserve-cleanup-issue
> +++ a/fs/ocfs2/xattr.c
> @@ -6395,6 +6395,10 @@ static int ocfs2_reflink_xattr_header(ha
>  					(void *)last - (void *)xe);
>  				memset(last, 0,
>  				       sizeof(struct ocfs2_xattr_entry));
> +				last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)] - 1;
> +			} else {
> +				memset(xe, 0, sizeof(struct ocfs2_xattr_entry));
> +				last = NULL;
>  			}
>  
>  			/*
> _
>