Re: [PATCH] ocfs2: validate bg_list.l_next_free_rec in discontig group descriptor

[ZhengYuan Huang]

On Wed, Apr 1, 2026 at 9:26 AM Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> wrote:
> >  fs/ocfs2/suballoc.c | 16 ++++++++++++++++
> >  1 file changed, 16 insertions(+)
> >
> > diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
> > index 6ac4dcd54588..6dcf45fda457 100644
> > --- a/fs/ocfs2/suballoc.c
> > +++ b/fs/ocfs2/suballoc.c
> > @@ -196,6 +196,22 @@ static int ocfs2_validate_gd_self(struct super_block *sb,
> >                        8 * le16_to_cpu(gd->bg_size));
> >       }
> >
> > +     /*
> > +      * For discontiguous block groups, validate that bg_list.l_next_free_rec
> > +      * does not exceed the maximum number of extent records that can physically
> > +      * fit in a single block.
> > +      */
> > +     if (ocfs2_gd_is_discontig(gd)) {
> > +             u16 max_recs = ocfs2_extent_recs_per_gd(sb);
> > +
> > +             if (le16_to_cpu(gd->bg_list.l_next_free_rec) > max_recs) {
>
> Since most places only check l_count, so why not validate l_count here
> as well?
> Something like:
>
> if (le16_to_cpu(el->l_count) != max_recs ||
>     le16_to_cpu(el->l_next_free_rec > le16_to_cpu(el->l_count))
>         ......
>
> Thanks,
> Joseph

Thanks for the suggestion!

I’ll incorporate the additional validation for l_count as well and
send a v2 patch shortly.

Thanks,
ZhengYuan Huang