[PATCH v2 0/2] ocfs2: xattr bucket validation fixes

[Joseph Qi]

This series fixes two problems around xattr bucket validation.

Patch 1 fixes a false-corruption failure on blocksize-512 volumes:
the bucket validator limited the entry array to the first bucket
block while the write path stores entries across the whole 4096-byte
bucket region, so a legitimately written, fsck-clean bucket could be
rejected and force the filesystem read-only.  It also adds an
alignment check on the bucket block number, since the entry array is
accessed as one contiguous region and a corrupted xattr tree could
otherwise point a bucket at blocks straddling a page boundary.

Patch 2 converts two mlog_bug_on_msg() checks in the bucket defrag
path to ocfs2_error() returns, so that a corrupt bucket holding
overlapping entries or an inflated xh_free_start marks the filesystem
read-only and fails the setxattr instead of panicking the kernel.

Both patches have been tested in QEMU: the blocksize-512 reproducer
(40 xattrs with 100-byte values, previously failing with "entry count
32 exceeds maximum 31") now passes with a clean fsck.ocfs2 result,
and the ocfs2 testsuite xattr tests pass 48/48 across blocksize
combinations.

Changes since v1:
- v1 was a single patch ("ocfs2: allow xattr bucket entries to span
  multiple blocks").  The series is now split into two fixes.
- Patch 1: reject buckets whose first block number is not aligned to
  the bucket size before validating the entry array; the flat entry
  access could otherwise read out of bounds for a bucket from a
  corrupted xattr tree that straddles a page boundary.
- Patch 2 is new: return an error instead of BUG() when defrag finds
  inconsistent bucket contents.

Joseph Qi (2):
  ocfs2: allow xattr bucket entries to span multiple blocks
  ocfs2: reject inconsistent xattr bucket during defrag

 fs/ocfs2/xattr.c | 37 +++++++++++++++++++++++++++++++------
 1 file changed, 31 insertions(+), 6 deletions(-)

-- 
2.39.3