Re: [PATCH] erofs-utils: lib: fix xattr prefix offset truncation

[Gao Xiang <xiang@kernel.org>]

Hi Bingying,

On Tue, Oct 20, 2026 at 01:52:18PM +0800, bingying lan wrote:
> xattr_prefix_start stores the long xattr prefix table offset in 4-byte
> units.  Casting the byte offset to u32 before shifting discards its
> upper bits, even though the overflow check accepts offsets whose
> shifted value fits in u32.  The table is written at the full offset,
> but the superblock points to the truncated location.
> 
> Shift the offset before narrowing it to u32.  This prevents corrupted
> images when incremental builds place the prefix table at or beyond
> 4 GiB.
> 
> Fixes: b6b741d8daaf ("erofs-utils: lib: get rid of tmpfile()")
> Signed-off-by: bingying lan <lanbingying.lby@linux.alibaba.com>
> ---
>  lib/xattr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/xattr.c b/lib/xattr.c
> index d86d94a..e742bfc 100644
> --- a/lib/xattr.c
> +++ b/lib/xattr.c
> @@ -921,7 +921,7 @@ int erofs_xattr_flush_name_prefixes(struct erofs_importer *im, bool plain)
>  		return -EOVERFLOW;
>  	start = offset;
>  
> -	sbi->xattr_prefix_start = (u32)offset >> 2;
> +	sbi->xattr_prefix_start = (u32)(offset >> 2);

Good catch:
Reviewed-by: Gao Xiang <xiang@kernel.org>

will move to -fixes after -rc1 is out.

Thanks,
Gao Xiang