Re: [PATCH v2] dax: fix wrong error code returned from dax_dedupe_file_range_compare()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] fs/dax: out-of-bounds length and size calculations in dax_range_compare_iter()
--

commit 01ad9c7e5da5c800a76808134a31ff80911b589c
Author: Jianyun Gao <jianyungao89@gmail.com>

dax: fix wrong error code returned from dax_dedupe_file_range_compare()

When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
dax_dedupe_file_range_compare() incorrectly returns ret which holds the
positive return value from iomap_iter() indicating more iterations remain.
This positive value leaks to the caller, where vfs_dedupe_file_range()
interprets it as success, causing userspace to incorrectly believe
deduplication completed.

> diff --git a/fs/dax.c b/fs/dax.c
> index 08adeaed2baf1..97b6212bfa898 100644
> --- a/fs/dax.c
> +++ b/fs/dax.c
> @@ -2254,7 +2254,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
>  		status = dax_range_compare_iter(&src_iter, &dst_iter,
>  				min(src_iter.len, dst_iter.len), same);
>  		if (status < 0)
> -			return ret;
> +			return status;

[Severity: High]
Does propagating this error code expose latent out-of-bounds calculations in
dax_range_compare_iter()?

Inside dax_range_compare_iter(), the length is incorrectly clamped using the
total extent length rather than the remaining mapped length:

fs/dax.c:dax_range_compare_iter() {
	...
	len = min(len, min(smap->length, dmap->length));
	...
}

If the file offset is inside the extent and the requested length is large, len
will exceed the valid remaining mapped length. This directly triggers a
WARN_ON_ONCE(count > iomap_length(iter)) in iomap_iter_advance() and aborts
with -EIO.

Additionally, when calling dax_iomap_direct_access(), the size calculation
uses the absolute file offset instead of a page offset:

fs/dax.c:dax_range_compare_iter() {
	...
	ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE),
				      &saddr, NULL);
	...
}

Since pos1 is an absolute file offset, for large file offsets this massive
size exceeds the physical device bounds, causing dax_iomap_direct_access()
to fail with -EINVAL.

Now that the error code is correctly propagated, will these calculations
actively cause dedupe operations to fail?

>  		src_iter.status = dst_iter.status = status;
>  	}
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012144925.6728-1-jianyungao89@gmail.com?part=1