From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 877252BEFF5; Sat, 22 Aug 2026 08:13:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787386400; cv=none; b=JQ1CSskYJL+px6KoWDnd+AMU7/yDKuHsfcwSFmm4ACwkufdtxBBCumCjC/FlGs6/z/Di1RUwcHbMp7/O0AZhe3NPSBAMjqxgp7xyEcEJQhGducPSrnIlmhk3hal19c51UGQBhbUWQz7N3eH7/lGMenJ6VnU1Du6uwkFcgNke7A4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787386400; c=relaxed/simple; bh=sSwiWm6ThDBx36iyLyoZ3eByT0ak/GlvGQj0oLg5ocg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=VS8bo2pJRnTDZT8tGXZ0uYYyfluNuTbjOA9438rB/+vjAEEWIObFPQRjoHm/PKJjg6Ys5NPKykZq9N0Qfi0gS/1UmM3kfrB3NO4JW+O4clIpW+v2dRWvPCpWL0Ns99LAJeLGb2s9CXSEHu3wFXKr2CN57Rcr+o1BH2rK1UExsfc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=H+Nhwq/I; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="H+Nhwq/I" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9700D1F000E9; Sat, 22 Aug 2026 08:13:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787386397; bh=PnBdpNK4+lJJrlw4BBESR4X9LQhYLt5se4dG/HegMvc=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=H+Nhwq/Io92fl0m6a/tUqM3u1TqhGKgcU8tfFbfE8kBCOojQ1XOdzknSFrgMU+41H 8NRvFAOVwYj2LKSpRHlc2Aeg9FuXEfPIMKy3UtIWfve/xeXXJ4zqaZ91sXbTyTT+dw kanrKgzLTzIrLabHOWfCi6rydWehVW5BhLWSqoUGWkGomycPInIMnes+gAFgdzjrrX zDlZgMztu06Ne4Os8CxAIdqumBLErQeZJon42TEc4tFG2aQ2SK2q6tBDf5T+kxDgdm eIt/sxQzWKoLh6bBUGI6F3EIsswZbHbzEnA8f8CpJlHR8h46Pj0GWBLCEtcqUEBbNM Fy4+EXCIc+K5g== Date: Sat, 22 Aug 2026 16:13:11 +0800 From: Zorro Lang To: "Darrick J. Wong" Cc: fstests , xfs , ljp1205831794@gmail.com Subject: Re: [PATCH] xfs: test reflux with exchange-range Message-ID: Mail-Followup-To: "Darrick J. Wong" , fstests , xfs , ljp1205831794@gmail.com References: <20260819155121.GA839663@frogsfrogsfrogs> Precedence: bulk X-Mailing-List: fstests@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260819155121.GA839663@frogsfrogsfrogs> On Wed, Aug 19, 2026 at 08:51:21AM -0700, Darrick J. Wong wrote: > From: Darrick J. Wong > > Regression test for the XFS_IOC_EXCHRANGE flag INO1_WRITTEN clearing > reflink flags when that shouldn't happen. > > Signed-off-by: "Darrick J. Wong" > --- > tests/generic/1957 | 72 ++++++++++++++++++++++++++++++++++++++++++++++++ > tests/generic/1957.out | 16 +++++++++++ > 2 files changed, 88 insertions(+) > create mode 100755 tests/generic/1957 > create mode 100644 tests/generic/1957.out > > diff --git a/tests/generic/1957 b/tests/generic/1957 > new file mode 100755 > index 00000000000000..bb039771970d15 > --- /dev/null > +++ b/tests/generic/1957 > @@ -0,0 +1,72 @@ > +#! /bin/bash > +# SPDX-License-Identifier: GPL-2.0 > +# Copyright (c) 2026 Oracle. All Rights Reserved. > +# > +# FS QA Test No. 1957 > +# > +# Regression test for refluxfs, which is an exploit for a race condition in > +# XFS' directio copy-on-write code that can be used to rewrite shared blocks > +# to gain root privileges. > +# > +. ./common/preamble > +_begin_fstest auto quick fiexchange > + > +_cleanup() > +{ > + cd / > + rm -r -f $tmp.* > + test -n "$dummydir" && rm -r -f "$dummydir" Hmm... what's the $dummydir? > +} > + > +. ./common/filter > +. ./common/reflink > + > +_require_scratch_reflink > +_require_xfs_io_command exchangerange OK, if a filesystem supports reflink and exchange-range, it definitely supports truncate I think. This patch is good enough, just not sure what's that "$dummydir". With the definition of dummydir clarified: Reviewed-by: Zorro Lang > +_require_cp_reflink > + > +_fixed_by_fs_commit xfs XXXXXXXXXXXXXX \ > + "xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN" > + > +_scratch_mkfs >> $seqres.full > +_scratch_mount > + > +# Create file1 as a fully written file, and file2 as a sparse file with one > +# written area. > +$XFS_IO_PROG -f -c "pwrite -S 0x58 0 1m" $SCRATCH_MNT/file1 >> $seqres.full > +$XFS_IO_PROG -f -c "truncate 1m" -c "pwrite -S 0x59 64k 64k" $SCRATCH_MNT/file2 >> $seqres.full > + > +_scratch_unmount > +_scratch_xfs_db -c "path /file1" -c 'print' -c "path /file2" -c 'print' | grep reflink > +_scratch_mount > + > +# Reflink file1 so that the reflink flag gets set > +_cp_reflink $SCRATCH_MNT/file1 $SCRATCH_MNT/fileC > + > +md5sum $SCRATCH_MNT/file1 $SCRATCH_MNT/file2 $SCRATCH_MNT/fileC | _filter_scratch > + > +# Exchange the written parts of file2 with file1, but only file1 has the > +# reflink flag set. > +$XFS_IO_PROG -c "exchangerange -w $SCRATCH_MNT/file2" $SCRATCH_MNT/file1 >> $seqres.full > + > +# Check reflink flags > +_scratch_unmount > +_scratch_xfs_db -c "path /file1" -c 'print' -c "path /file2" -c 'print' | grep reflink > +_scratch_mount > + > +# Record content and layout > +md5sum $SCRATCH_MNT/file1 $SCRATCH_MNT/file2 $SCRATCH_MNT/fileC | _filter_scratch > +$XFS_IO_PROG -c 'bmap -vvvvvvvv' $SCRATCH_MNT/file[12C] >> $seqres.full > + > +# Write a single byte to file1, does that get echoed in fileC? > +$XFS_IO_PROG -c 'pwrite -S 0x59 0 1' $SCRATCH_MNT/file1 >> $seqres.full > +# > +# Check reflink flags > +_scratch_unmount > +_scratch_xfs_db -c "path /file1" -c 'print' -c "path /file2" -c 'print' | grep reflink > +_scratch_mount > + > +md5sum $SCRATCH_MNT/file1 $SCRATCH_MNT/file2 $SCRATCH_MNT/fileC | _filter_scratch > +$XFS_IO_PROG -c 'bmap -vvvvvvvv' $SCRATCH_MNT/file[12C] >> $seqres.full > + > +_exit 0 > diff --git a/tests/generic/1957.out b/tests/generic/1957.out > new file mode 100644 > index 00000000000000..7d64ea0e2c372d > --- /dev/null > +++ b/tests/generic/1957.out > @@ -0,0 +1,16 @@ > +QA output created by 1957 > +v3.reflink = 0 > +v3.reflink = 0 > +310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/file1 > +e6ee47dca6e786a44ae5b912be870d96 SCRATCH_MNT/file2 > +310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/fileC > +v3.reflink = 1 > +v3.reflink = 1 > +b630c7de58afd0ba5b8dfa24d701b5b8 SCRATCH_MNT/file1 > +18cc9868973139a0bb558e09802a51b6 SCRATCH_MNT/file2 > +310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/fileC > +v3.reflink = 1 > +v3.reflink = 1 > +82b27c6f1b1de8fba44a911af80d9a7a SCRATCH_MNT/file1 > +18cc9868973139a0bb558e09802a51b6 SCRATCH_MNT/file2 > +310f146ce52077fcd3308dcbe7632bb2 SCRATCH_MNT/fileC