Re: [PATCH] ocfs2: validate dr_fs_generation of dir index root blocks

[Heming Zhao]

On Fri, Sep 04, 2026 at 07:15:51PM +0800, Joseph Qi wrote:
> ocfs2_validate_dx_root() does not verify dr_fs_generation against the
> superblock generation, unlike the extent and xattr block validators
> which check h_fs_generation and xb_fs_generation respectively.  The
> field is documented as "Must match super block".
> 
> Without the check, a stale dir index root block left on the device from
> a previously formatted filesystem at the same physical block number can
> pass validation as long as its signature, dr_blkno and checksum match.
> Its index entries and suballocator information would then be used in
> the new filesystem context.
> 
> Reject dir index root blocks whose dr_fs_generation does not match the
> mounted filesystem, like the extent and xattr block validators do.
> 
> Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>

LGTM.
Reviewed-by: Heming Zhao <heming.zhao@xxxxxxxx>
> ---
>  fs/ocfs2/dir.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
> index 6bb6aa133f01..329680b46227 100644
> --- a/fs/ocfs2/dir.c
> +++ b/fs/ocfs2/dir.c
> @@ -613,6 +613,14 @@ static int ocfs2_validate_dx_root(struct super_block *sb,
>  		goto bail;
>  	}
>  
> +	if (le32_to_cpu(dx_root->dr_fs_generation) != OCFS2_SB(sb)->fs_generation) {
> +		ret = ocfs2_error(sb,
> +				  "Dir Index Root # %llu has an invalid dr_fs_generation of #%u\n",
> +				  (unsigned long long)bh->b_blocknr,
> +				  le32_to_cpu(dx_root->dr_fs_generation));
> +		goto bail;
> +	}
> +
>  	/*
>  	 * Dir index root blocks are allocated from a per-slot suballocator,
>  	 * so the slot must be in range.  Otherwise removing the index passes
> -- 
> 2.39.3
>