Re: [PATCH v2] ocfs2: update xattr count before moving bucket entries

[Heming Zhao <heming.zhao@suse.com>]

On Wed, Sep 16, 2026 at 10:47:50AM +0800, Su Yue wrote:
> Since commit 2f26f58df041 ("ocfs2: annotate flexible array members
> with __counted_by_le()"), the xh_entries array is annotated with
> __counted_by_le(xh_count), so FORTIFY uses xh_count to determine its
> bounds. When inserting an entry into a bucket, ocfs2_xa_bucket_add_entry()
> shifts existing entries before incrementing xh_count.
> The destination therefore extends one entry past the bounds described
> by the old count.
> 
> With CONFIG_CC_HAS_COUNTED_BY and CONFIG_FORTIFY_SOURCE enabled,
> ocfs2-test: single_run-WIP.sh -t reflink triggers the following failure
> while adding an extended attribute:
> 
> [  150.156484] memmove: detected buffer overflow: 352 byte write of buffer size 336
> [  150.156487] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3d/0x50, CPU#15: reflink_test/2336
> [  150.160496] RIP: 0010:__fortify_report+0x40/0x50
> [  150.164031] Call Trace:
> [  150.164141]  <TASK>
> [  150.164232]  __fortify_panic+0x9/0xb
> [  150.164383]  ocfs2_xa_bucket_add_entry.cold+0x17/0x28 [ocfs2]
> [  150.164661]  ocfs2_xa_set+0x8fb/0xf40 [ocfs2]
> 
> Increment xh_count before memmove() so the destination bounds include
> the new entry. Keep the local count unchanged to calculate the insertion
> position and move length from the original number of entries. The caller
> has already checked that there is enough space for the new entry.
> 
> Signed-off-by: Su Yue <glass.su@suse.com>

LGTM.
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
> ---
> Changelog:
> v2:
>    Remove fixes tag, mention the commit id in message.
> ---
>  fs/ocfs2/xattr.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
> index 35bcbb0ff607b..49d82ea5a1271 100644
> --- a/fs/ocfs2/xattr.c
> +++ b/fs/ocfs2/xattr.c
> @@ -2076,12 +2076,17 @@ static void ocfs2_xa_bucket_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
>  		}
>  	}
>  
> +	/*
> +	 * Increment xh_count before memmove() so __counted_by_le(xh_count)
> +	 * includes the new entry in the destination bounds.
> +	 */
> +	le16_add_cpu(&xh->xh_count, 1);
> +
>  	if (low != count)
>  		memmove(&xh->xh_entries[low + 1],
>  			&xh->xh_entries[low],
>  			((count - low) * sizeof(struct ocfs2_xattr_entry)));
>  
> -	le16_add_cpu(&xh->xh_count, 1);
>  	loc->xl_entry = &xh->xh_entries[low];
>  	memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
>  }
> -- 
> 2.55.0
>