Re: [PATCH] xfs: validate btree block level on read

[David Lee]

Hi Dave,

Thanks for the review. I reproduced the issue on October 23, 2026 with
the unchanged original PoC on mainline commit
734bef548a96e8774d6eef5dfa2026c6edc4e80b
(7.3.0-package1-2-20-xfs-mainline).

The cause is a wrong-level sibling: a level-1 node's left-sibling
pointer references a checksum-valid level-0 RTRMAP leaf with 100
records. The leaf verifier accepts that count because its limit is 167.
But lshift uses the internal-node layout, whose limit is 83. Its
equality check misses 100, increments the count to 101, and copies a
40-byte key pair at offset 4072, overrunning the 4 KiB buffer by 16
bytes.

The log reports the invalid write as a KASAN use-after-free in
xfs_btree_lshift through inodegc. It introduces out-of-bounds key write
described above.

Attached poc.c, the detailed report.txt, and full_kasan.log.

If this looks like the right direction, I'll send v2 with the corrected
tags.

For reference, here is the original mail thread:
https://lore.kernel.org/linux-xfs/20260731120344.558808-1-david.lee@xxxxxxxxxxxxxxx/

Best regards,
David

Attachment: poc.c
Description: Binary data

Attachment: report.txt
Description: Binary data

Attachment: full_kasan.log
Description: Binary data