[PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[Stian Halseth]

An rmapbt node stores each key as a low/high pair of packed 20-byte
struct xfs_rmap_key, so every high key is only 4-byte aligned.
union xfs_btree_key is 8-byte aligned, which lets the compiler read
rm_offset through it with an 8-byte load.  On sparc64 every high key
checked by xchk_rmapbt_check_unwritten_in_keyflags() then takes an
unaligned access trap:

  Kernel unaligned access at TPC[105a54d8] xchk_rmapbt_check_unwritten_in_keyflags+0xb8/0x160 [xfs]

Use get_unaligned() for the high key.

Fixes: 38384569a2a8 ("xfs: detect unwritten bit set in rmapbt node block keys")
Reported-by: Jan Engelhardt <jengelh@inai.de>
Closes: https://github.com/sparclinux/issues/issues/115
Cc: stable@vger.kernel.org # v6.4+
Signed-off-by: Stian Halseth <stian@itx.no>
---
Tested on sparc64 (T4, 7.3.3) by scrubbing the rmapbt of a loop-mounted
image: alignment faults per scrub went from about 4000 to 0.

 fs/xfs/scrub/rmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/rmap.c b/fs/xfs/scrub/rmap.c
index 68e2847c962bb..d0578800f3e41 100644
--- a/fs/xfs/scrub/rmap.c
+++ b/fs/xfs/scrub/rmap.c
@@ -174,7 +174,7 @@ xchk_rmapbt_check_unwritten_in_keyflags(
 			}
 
 			hkey = xfs_btree_high_key_addr(cur, ptr, keyblock);
-			if (hkey->rmap.rm_offset & badflag) {
+			if (get_unaligned(&hkey->rmap.rm_offset) & badflag) {
 				xchk_btree_set_preen(sc, cur, level);
 				break;
 			}
-- 
2.43.0

Re: [PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[Dave Chinner]

On Mon, Nov 09, 2026 at 02:48:53PM +0100, Stian Halseth wrote:
> An rmapbt node stores each key as a low/high pair of packed 20-byte
> struct xfs_rmap_key, so every high key is only 4-byte aligned.
> union xfs_btree_key is 8-byte aligned, which lets the compiler read
> rm_offset through it with an 8-byte load.  On sparc64 every high key
> checked by xchk_rmapbt_check_unwritten_in_keyflags() then takes an
> unaligned access trap:
> 
>   Kernel unaligned access at TPC[105a54d8] xchk_rmapbt_check_unwritten_in_keyflags+0xb8/0x160 [xfs]
> 
> Use get_unaligned() for the high key.
> 
> Fixes: 38384569a2a8 ("xfs: detect unwritten bit set in rmapbt node block keys")
> Reported-by: Jan Engelhardt <jengelh@inai.de>
> Closes: https://github.com/sparclinux/issues/issues/115
> Cc: stable@vger.kernel.org # v6.4+
> Signed-off-by: Stian Halseth <stian@itx.no>
> ---
> Tested on sparc64 (T4, 7.3.3) by scrubbing the rmapbt of a loop-mounted
> image: alignment faults per scrub went from about 4000 to 0.
> 
>  fs/xfs/scrub/rmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/scrub/rmap.c b/fs/xfs/scrub/rmap.c
> index 68e2847c962bb..d0578800f3e41 100644
> --- a/fs/xfs/scrub/rmap.c
> +++ b/fs/xfs/scrub/rmap.c
> @@ -174,7 +174,7 @@ xchk_rmapbt_check_unwritten_in_keyflags(
>  			}
>  
>  			hkey = xfs_btree_high_key_addr(cur, ptr, keyblock);
> -			if (hkey->rmap.rm_offset & badflag) {
> +			if (get_unaligned(&hkey->rmap.rm_offset) & badflag) {
>  				xchk_btree_set_preen(sc, cur, level);
>  				break;
>  			}

That just looks wrong to begin with. Decoding an on-disk structure
without using be64_to_cpu() to get it in the correct endian order
first?

Oh... the code plays "I'm too smart for my own good" micro-
optimisation games by endian swapping the badflag variable to avoid
needing to endian swap the rm_offset field.

It seems to me that the correct fix here is to stop endian swapping
the badflag variable, and endian swap the rmap.rm_offset fetches for
both the low key and high keys, like all the other places that
dereference rmap.rm_offset direct from pointers returned by
xfs_btree_key_addr()/xfs_btree_high_key_addr().

Cheers,

Dave.
-- 
Dave Chinner
dgc@kernel.org

Re: [PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[Stian Halseth]

[-- Attachment #1: Type: text/plain, Size: 1488 bytes --]

Hi Dave,

On Tue, 2026-11-10 at 08:40 +1100, Dave Chinner wrote:
> 
> That just looks wrong to begin with. Decoding an on-disk structure
> without using be64_to_cpu() to get it in the correct endian order
> first?
> 
> Oh... the code plays "I'm too smart for my own good" micro-
> optimisation games by endian swapping the badflag variable to avoid
> needing to endian swap the rm_offset field.
> 
> It seems to me that the correct fix here is to stop endian swapping
> the badflag variable, and endian swap the rmap.rm_offset fetches for
> both the low key and high keys, like all the other places that
> dereference rmap.rm_offset direct from pointers returned by
> xfs_btree_key_addr()/xfs_btree_high_key_addr().
> 

Thanks, I've looked a bit deeper than my one-line fix, based on your
feedback.

Yes, we can remove badflag. be64_to_cpu() alone doesn't fix the
trap, though, since it's a no-op on big-endian. gcc still reads
hkey->rmap.rm_offset with the same 8-byte ldx. I tried it on my
T4-1 and the fault count didn't change.

The other places get away with it because they go through a
struct xfs_rmap_key pointer first (kp = &key->rmap in
xfs_rmapbt_cmp_key_with_cur() and xfs_rmapbt_cmp_two_keys()), and since
that struct is packed gcc uses byte loads.

I suggest we do the the same here, with be64_to_cpu() and no badflag.
That gets the faults to zero on the T4-1. Can send that as a v2 later,
if no one disagree with that approach.

/Stian

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[Dave Chinner]

On Tue, Nov 10, 2026 at 09:33:46AM +0100, Stian Halseth wrote:
> Hi Dave,
> 
> On Tue, 2026-11-10 at 08:40 +1100, Dave Chinner wrote:
> > 
> > That just looks wrong to begin with. Decoding an on-disk structure
> > without using be64_to_cpu() to get it in the correct endian order
> > first?
> > 
> > Oh... the code plays "I'm too smart for my own good" micro-
> > optimisation games by endian swapping the badflag variable to avoid
> > needing to endian swap the rm_offset field.
> > 
> > It seems to me that the correct fix here is to stop endian swapping
> > the badflag variable, and endian swap the rmap.rm_offset fetches for
> > both the low key and high keys, like all the other places that
> > dereference rmap.rm_offset direct from pointers returned by
> > xfs_btree_key_addr()/xfs_btree_high_key_addr().
> > 
> 
> Thanks, I've looked a bit deeper than my one-line fix, based on your
> feedback.
> 
> Yes, we can remove badflag. be64_to_cpu() alone doesn't fix the
> trap, though, since it's a no-op on big-endian. gcc still reads
> hkey->rmap.rm_offset with the same 8-byte ldx. I tried it on my
> T4-1 and the fault count didn't change.
> 
> The other places get away with it because they go through a
> struct xfs_rmap_key pointer first (kp = &key->rmap in
> xfs_rmapbt_cmp_key_with_cur() and xfs_rmapbt_cmp_two_keys()), and since
> that struct is packed gcc uses byte loads.

Ah, that explains why those work without issue - that's the bit I
missed.

> I suggest we do the the same here, with be64_to_cpu() and no badflag.
> That gets the faults to zero on the T4-1. Can send that as a v2 later,
> if no one disagree with that approach.

It sounds like the right approach to me.

-Dave.
-- 
Dave Chinner
dgc@kernel.org