[PATCH v3] dax: fix wrong error code returned from dax_dedupe_file_range_compare()

[PATCH v3] dax: fix wrong error code returned from dax_dedupe_file_range_compare()

[jianyungao89]

From: Jianyun Gao <jianyungao89@gmail.com>

When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
positive return value from iomap_iter() indicating more iterations remain.
This positive value leaks to the caller, where vfs_dedupe_file_range()
interprets it as success (bytes_deduped = len), causing userspace to
incorrectly believe deduplication completed.

Return 'status' instead to propagate the actual error code.

Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
---
Changes in v3:
- Fix the Fixes tag to point to the commit that actually introduced
  the bug (0e79e3736d54), not the one that renamed the variable
- Add Reviewed-by from Darrick J. Wong

Link: https://lore.kernel.org/lkml/20261012144925.6728-1-jianyungao89@gmail.com/ # v2
 fs/dax.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dax.c b/fs/dax.c
index 6ba50142eeb2..1f6a4fbb97bd 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2261,7 +2261,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
 		status = dax_range_compare_iter(&src_iter, &dst_iter,
 				min(src_iter.len, dst_iter.len), same);
 		if (status < 0)
-			return ret;
+			return status;
 		src_iter.status = dst_iter.status = status;
 	}
 	return ret;
-- 
2.34.1

Re: [PATCH v3] dax: fix wrong error code returned from dax_dedupe_file_range_compare()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] fsdax: incorrect size parameter in dax_range_compare_iter causes massive direct access requests
--

commit 65ff21563702a9036c338f4961a061d5c576d038
Author: Jianyun Gao <jianyungao89@gmail.com>

dax: fix wrong error code returned from dax_dedupe_file_range_compare()

This commit fixes a bug in dax_dedupe_file_range_compare() where a positive
return value was incorrectly propagated on failure. It now correctly returns
the negative error code from dax_range_compare_iter().

Link: https://lore.kernel.org/lkml/20261012144925.6728-1-jianyungao89@gmail.com/

> diff --git a/fs/dax.c b/fs/dax.c
> index 08adeaed2baf1..97b6212bfa898 100644
> --- a/fs/dax.c
> +++ b/fs/dax.c
> @@ -2254,7 +2254,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
>  		status = dax_range_compare_iter(&src_iter, &dst_iter,
>  				min(src_iter.len, dst_iter.len), same);
>  		if (status < 0)
> -			return ret;
> +			return status;

[Severity: High]
By correctly propagating the error code here, does this patch now expose a
bug in dax_range_compare_iter() that will break dedupe for large offsets?

Looking at dax_range_compare_iter() in fs/dax.c, it appears to pass an
absolute end offset instead of a length as the size parameter to
dax_iomap_direct_access():

static int dax_range_compare_iter(...)
{
	...
	ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE),
				      &saddr, NULL);
	...
}

When dax_iomap_direct_access() receives this size parameter, it converts it
via PHYS_PFN() and interprets the massive absolute offset as a relative
length:

fs/dax.c:dax_iomap_direct_access() {
	...
	length = dax_direct_access(iomap->dax_dev, pgoff, PHYS_PFN(size),
				   DAX_ACCESS, kaddr, pfnp);
	...
}

This requests an out-of-bounds mapping length from the underlying block
driver (up to pos1 + len instead of just len), which typically fails with
-EINVAL or -EIO for offsets that exceed device bounds.

Since this patch changes the behavior from a silent pseudo-success to an
explicit failure, will standard deduplication at non-zero offsets now
consistently fail when dax_range_compare_iter() erroneously asks for an
enormous number of pages?

>  		src_iter.status = dst_iter.status = status;
>  	}
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015143426.17620-1-jianyungao89@gmail.com?part=1

Re: [PATCH v3] dax: fix wrong error code returned from dax_dedupe_file_range_compare()

[Alison Schofield]

On Thu, Oct 15, 2026 at 10:34:25PM +0800, jianyungao89@gmail.com wrote:
> From: Jianyun Gao <jianyungao89@gmail.com>
> 
> When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
> dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
> positive return value from iomap_iter() indicating more iterations remain.
> This positive value leaks to the caller, where vfs_dedupe_file_range()
> interprets it as success (bytes_deduped = len), causing userspace to
> incorrectly believe deduplication completed.
> 
> Return 'status' instead to propagate the actual error code.

Hi Jianyun,

I looked at merging this today but the Sashiko response stopped me.

I do see you addressed Sashiko in v1, ignored Sashiko in v2.
If this v3 Sashiko complaint is one you've already addressed, please
reply saying so. Thanks!

-- Alison

> 
> Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
> Reviewed-by: Jan Kara <jack@suse.cz>
> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
> ---
> Changes in v3:
> - Fix the Fixes tag to point to the commit that actually introduced
>   the bug (0e79e3736d54), not the one that renamed the variable
> - Add Reviewed-by from Darrick J. Wong
> 
> Link: https://lore.kernel.org/lkml/20261012144925.6728-1-jianyungao89@gmail.com/ # v2
>  fs/dax.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/dax.c b/fs/dax.c
> index 6ba50142eeb2..1f6a4fbb97bd 100644
> --- a/fs/dax.c
> +++ b/fs/dax.c
> @@ -2261,7 +2261,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
>  		status = dax_range_compare_iter(&src_iter, &dst_iter,
>  				min(src_iter.len, dst_iter.len), same);
>  		if (status < 0)
> -			return ret;
> +			return status;
>  		src_iter.status = dst_iter.status = status;
>  	}
>  	return ret;
> -- 
> 2.34.1
> 
>