Re: [PATCH v2] xfs: fix exchange-range-to-eof file size exchange

[Dave Chinner <dgc@kernel.org>]

On Wed, Oct 07, 2026 at 10:02:27AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> Norbert Szetei posted a patch containing an incomplete description of a
> bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag.  The bug tricks
> exchange-range into modifying a file so that it has shared blocks
> starting beyond EOF, which is never allowed because files never have
> written data beyond EOF, and you can only share written data blocks.
> This is key to all the incorrect behavior that follows.
.....
> @@ -1005,10 +1006,18 @@ xfs_exchmaps_init_intent(
>  		return xmi;
>  	}
>  
> +	/*
> +	 * If the caller wanted, set each file's size to that file's exchange
> +	 * offset + length exchanged from the other file because the ranges in
> +	 * each file might be different lengths.
> +	 */
>  	if (req->flags & XFS_EXCHMAPS_SET_SIZES) {
> +		loff_t	off1 = XFS_FSB_TO_B(mp, xmi->xmi_startoff1);
> +		loff_t	off2 = XFS_FSB_TO_B(mp, xmi->xmi_startoff2);
> +
>  		xmi->xmi_flags |= XFS_EXCHMAPS_SET_SIZES;
> -		xmi->xmi_isize1 = req->ip2->i_disk_size;
> -		xmi->xmi_isize2 = req->ip1->i_disk_size;
> +		xmi->xmi_isize1 = off1 + (req->ip2->i_disk_size - off2);
> +		xmi->xmi_isize2 = off2 + (req->ip1->i_disk_size - off1);
>  	}

Yup, that comment helps :)

Rest of the fix looks good, too.

Reviewed-by: Dave Chinner <dchinner@redhat.com>

-- 
Dave Chinner
dgc@kernel.org