From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590398; b=bLTiqBb5xOai5jKHN/ck1UegZepHnVm6zBDJ8LK0II91ockmUZ5hHRhPq1G6rNGPRs6e zN5JsB7HiVl/2iBNmnlyB1KwCl2e6jS+oYvERd1QSQ/A7v9wyAThPAQOJcJq/2oiWQ3Om L4X4/bmR+RqBrucp/VLTgvstlBTU+CknKOSO+bsVxOkE+Gq5C51+g0CBy+jvs9+9SkPwX qMMwN62lBRyaXdU5VZOXCYhInn7dzpzFuqKD48V7XX+PBuB5WqRpZ/wSdu/zuWC1Oiffy pagfPKyMuMbegO0zO5xWSDr4Hgz0KT8tDJocRs4YCNKiRubZrtmawbIj8n7DLqEPMmA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590398; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=CbpSBYWQnAHtXlPo5lG19ijHsUvAtlZof8kBEKniBtw=; b=TvsVm6CJJ+3lkO+xESGdnJxw9QohY+INwHyY46t1b71m7gGkRqWtcO47EQvsJ3d27miH TrCnC3tcoRWLZwElpS/SrUthomOchxOaSp8iQZnKH8u5ySbNIymDTndiJTy69nCFtSmSt tBt69BkqVkUXDiYrxTTKSk0mj3or+3XgZMGwbkDtVikkcuh+6B7y+IowNODtVluNU3Nln g9SsHh2Isyp15h3FGsKdfPBLitgKm5Puk7tHnkLmkeE9V9Xf+MRVxGManhSSik8amEhoB nX9JOSnrMc5S2QRIgZkIsQ8FiTGlgy3S5fqteE3XOsDpjnTyApgCRHgc+H2wIE46Efg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=q6ANa+Ad; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CC54606B44D; Fri, 13 Nov 2026 17:19:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=q6ANa+Ad Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5B5E1F000C4; Fri, 13 Nov 2026 17:19:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590397; bh=CbpSBYWQnAHtXlPo5lG19ijHsUvAtlZof8kBEKniBtw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=q6ANa+AdKM+RNqMX1z8x4/iPBiJ3bx9D1uVMOaKY3mE622zhpvRXMj4vU2FErdJKC wJMARmvFr/2FhkmYltJMQb+DrCbywOZub6uf0UFcziNb5gbOeTuwIemF1BlNdAaCpE vTfwqE/9V3UBE9nk27WUQVAKouU7HTVnAFYl0iJg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Joseph Qi , Andrew Morton , Heming Zhao , Mark Fasheh , Joel Becker , Sasha Levin Subject: [PATCH 6.18 324/686] ocfs2: find the xattr entry again after defragmenting a bucket Date: Fri, 13 Nov 2026 10:47:37 -0500 Message-ID: <20261113153831.909391472@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joseph Qi [ Upstream commit 9a40c050f58344615a0604701b5d299519833163 ] ocfs2_xattr_set_entry_bucket() hands loc.xl_entry to ocfs2_xa_set() twice: once for the bucket as it stands, and, if that reports -ENOSPC, once more after ocfs2_defrag_xattr_bucket() has packed the name/value pairs down. Defragmenting ends by sorting the entry array on xe_name_hash. Buckets are kept sorted, so the sort only permutes entries that share a hash, but lib/sort.c is an unstable heapsort and it does permute them. loc.xl_entry is an address inside xh_entries[], so afterwards it denotes whichever entry landed in that slot rather than the one the search found. The second ocfs2_xa_set() then works on the wrong entry. Nothing on that path compares the entry's name with xi->xi_name, so what happens depends on how the two entries compare in size: ocfs2_xa_reuse_entry() trips its BUG_ON() when the padded name sizes differ, and otherwise the new value is written into the neighbouring attribute's value slot while the attribute being set is left untouched. setxattr() reports success either way. Remember the entry's hash before defragmenting and look the entry up again afterwards, the way ocfs2_xattr_bucket_find() does. An entry that cannot be found again means the bucket no longer holds what the search found, so fail with -EFSCORRUPTED rather than writing through the stale pointer. Link: https://lore.kernel.org/20261024151012.1059683-3-joseph.qi@linux.alibaba.com Fixes: 012255961c9e ("ocfs2: Enable xattr set in index btree") Signed-off-by: Joseph Qi Signed-off-by: Andrew Morton Cc: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Signed-off-by: Sasha Levin --- fs/ocfs2/xattr.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 734801de8e89e..e83db0ca737a6 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -5635,13 +5635,18 @@ static int ocfs2_xattr_set_entry_bucket(struct inode *inode, struct ocfs2_xattr_search *xs, struct ocfs2_xattr_set_ctxt *ctxt) { - int ret; + int ret, found = 0; + u16 xe_index; + u32 name_hash; struct ocfs2_xa_loc loc; trace_ocfs2_xattr_set_entry_bucket(xi->xi_name); ocfs2_init_xattr_bucket_xa_loc(&loc, xs->bucket, xs->not_found ? NULL : xs->here); + /* Defragmenting below may move this entry, so remember its hash. */ + name_hash = loc.xl_entry ? le32_to_cpu(loc.xl_entry->xe_name_hash) : 0; + ret = ocfs2_xa_set(&loc, xi, ctxt); if (!ret) { xs->here = loc.xl_entry; @@ -5660,6 +5665,29 @@ static int ocfs2_xattr_set_entry_bucket(struct inode *inode, goto out; } + /* + * ocfs2_defrag_xattr_bucket() sorts the entries by name hash and + * lib/sort.c is not stable, so entries sharing a hash may have traded + * slots. Look the entry up again before writing through it. + */ + if (loc.xl_entry) { + ret = ocfs2_find_xe_in_bucket(inode, xs->bucket, + xi->xi_name_index, xi->xi_name, + name_hash, &xe_index, &found); + if (ret) { + mlog_errno(ret); + goto out; + } + if (!found) { + mlog(ML_ERROR, "xattr entry not found in bucket %llu after defrag\n", + (unsigned long long)bucket_blkno(xs->bucket)); + ret = -EFSCORRUPTED; + goto out; + } + loc.xl_entry = &bucket_xh(xs->bucket)->xh_entries[xe_index]; + xs->here = loc.xl_entry; + } + ret = ocfs2_xa_set(&loc, xi, ctxt); if (!ret) { xs->here = loc.xl_entry; -- 2.53.0