Re: [PATCH v2] ocfs2: update xattr count before moving bucket entries

[Andrew Morton <akpm@linux-foundation.org>]

On Wed, 16 Sep 2026 10:47:50 +0800 Su Yue <glass.su@suse.com> wrote:

> Since commit 2f26f58df041 ("ocfs2: annotate flexible array members
> with __counted_by_le()"), the xh_entries array is annotated with
> __counted_by_le(xh_count), so FORTIFY uses xh_count to determine its
> bounds. When inserting an entry into a bucket, ocfs2_xa_bucket_add_entry()
> shifts existing entries before incrementing xh_count.
> The destination therefore extends one entry past the bounds described
> by the old count.
> 
> With CONFIG_CC_HAS_COUNTED_BY and CONFIG_FORTIFY_SOURCE enabled,
> ocfs2-test: single_run-WIP.sh -t reflink triggers the following failure
> while adding an extended attribute:
> 
> [  150.156484] memmove: detected buffer overflow: 352 byte write of buffer size 336
> [  150.156487] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3d/0x50, CPU#15: reflink_test/2336
> [  150.160496] RIP: 0010:__fortify_report+0x40/0x50
> [  150.164031] Call Trace:
> [  150.164141]  <TASK>
> [  150.164232]  __fortify_panic+0x9/0xb
> [  150.164383]  ocfs2_xa_bucket_add_entry.cold+0x17/0x28 [ocfs2]
> [  150.164661]  ocfs2_xa_set+0x8fb/0xf40 [ocfs2]
> 
> Increment xh_count before memmove() so the destination bounds include
> the new entry. Keep the local count unchanged to calculate the insertion
> position and move length from the original number of entries. The caller
> has already checked that there is enough space for the new entry.
> 

Thanks, I added

Fixes: 2f26f58df041 ("ocfs2: annotate flexible array members with __counted_by_le()")
Cc: <stable@vger.kernel.org>

to this, which I assume is appropriate.