Re: [PATCH RESEND 0/1] ocfs2: fix reflink preserve cleanup issue

[Heming Zhao]

On Mon, Jan 19, 2026 at 03:53:53PM -0800, Andrew Morton wrote:
> On Thu, 18 Dec 2025 22:42:12 +0800 Heming Zhao <heming.zhao@xxxxxxxx> wrote:
> 
> > ping...
> > 
> 
> yes please ;)  Some review input would be reassuring, thanks.
> 
> btw, I forgot to ask: what are the worst-case userspace-visible runtime
> effects of this bug?

The worst-case scenario was fixed in commit c06c303832ec ('ocfs2: fix xattr array
entry __counted_by error'). It resolved an out-of-bounds (OOB) issue that could
have caused the kernel to crash.

In patch commit log, there are two issues:
1> the 'last' pointer should be shifted by one unit after cleanup
   an array entry.
2> current code logic doesn't cleanup the first entry when xh_count is 1.

The following points should be noted:

Regarding <1>: after commit c06c303832ec, the last pointer doesn't shift. The
code always clears the last array element.

Regarding <2>: Since the existing code correctly updates new_xh->xh_count, the
xattrs can still be displayed correctly (shown as empty) even if the first entry
is not cleared, as the logic relies on the count.

> 
> IOW, is a -stable backport desirable?

Yes

- Heming
> 
> 
> From: Heming Zhao <heming.zhao@xxxxxxxx>
> Subject: ocfs2: fix reflink preserve cleanup issue
> Date: Wed, 10 Dec 2025 09:57:24 +0800
> 
> commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error")
> doesn't handle all cases and the cleanup job for preserved xattr entries
> still has bug:
> - the 'last' pointer should be shifted by one unit after cleanup
>   an array entry.
> - current code logic doesn't cleanup the first entry when xh_count is 1.
> 
> Note, commit c06c303832ec is also a bug fix for 0fe9b66c65f3.
> 
> Link: https://lkml.kernel.org/r/20251210015725.8409-2-heming.zhao@xxxxxxxx
> Fixes: 0fe9b66c65f3 ("ocfs2: Add preserve to reflink.")
> Signed-off-by: Heming Zhao <heming.zhao@xxxxxxxx>
> Cc: Mark Fasheh <mark@xxxxxxxxxx>
> Cc: Joel Becker <jlbec@xxxxxxxxxxxx>
> Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx>
> Cc: Joseph Qi <jiangqi903@xxxxxxxxx>
> Cc: Changwei Ge <gechangwei@xxxxxxx>
> Cc: Jun Piao <piaojun@xxxxxxxxxx>
> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> ---
> 
>  fs/ocfs2/xattr.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> --- a/fs/ocfs2/xattr.c~ocfs2-fix-reflink-preserve-cleanup-issue
> +++ a/fs/ocfs2/xattr.c
> @@ -6395,6 +6395,10 @@ static int ocfs2_reflink_xattr_header(ha
>  					(void *)last - (void *)xe);
>  				memset(last, 0,
>  				       sizeof(struct ocfs2_xattr_entry));
> +				last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)] - 1;
> +			} else {
> +				memset(xe, 0, sizeof(struct ocfs2_xattr_entry));
> +				last = NULL;
>  			}
>  
>  			/*
> _
>