Re: [PATCH] xfs: validate btree block level on read

[Dave Chinner <dgc@kernel.org>]

On Fri, Jul 31, 2026 at 12:03:42PM +0000, David Lee wrote:
> Btree buffer verifiers validate record counts against the level stored in
> the block itself.  Callers of xfs_btree_read_buf_block(), however, use
> the returned block according to the level they are traversing.  A
> corrupted sibling pointer can therefore return a verifier-valid block
> from another level and cause out-of-bounds accesses when layout-specific
> entries are moved.
> 
> Pass the expected level into xfs_btree_read_buf_block() and reject
> blocks whose on-disk level differs before returning them.  This
> centralizes the check for traversal and sibling reads.

We already have a centralised function that does all this level
check (and more): xfs_btree_lookup_get_block(). It is already passed
the expected level, and it also checks various other per-usage
header information like owner, level specific numrecs bounds, etc.

If we have to verify per-block context state, then nothing should be
calling xfs_btree_read_buf_block() directly except
xfs_btree_lookup_get_block(), and all the read context checks should
be performed in xfs_btree_lookup_get_block() (as they already are).

> Fixes: 3d3e6f64e22c ("xfs: verify btree blocks as they are read from disk")
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.

Great. How did you reproduce the issue and test the fix is correct?
Did you submit an fstests that reproduces the issue and verifies the
fix works?

> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Yeah, nah. Patches have to be submitted by a real person, not a bot
account, and SOB should reflect that.

-Dave.
-- 
Dave Chinner
dgc@kernel.org