Re: [PATCH] xfs: read rmapbt high key offsets with get_unaligned() in scrub

[Dave Chinner <dgc@kernel.org>]

On Mon, Nov 09, 2026 at 02:48:53PM +0100, Stian Halseth wrote:
> An rmapbt node stores each key as a low/high pair of packed 20-byte
> struct xfs_rmap_key, so every high key is only 4-byte aligned.
> union xfs_btree_key is 8-byte aligned, which lets the compiler read
> rm_offset through it with an 8-byte load.  On sparc64 every high key
> checked by xchk_rmapbt_check_unwritten_in_keyflags() then takes an
> unaligned access trap:
> 
>   Kernel unaligned access at TPC[105a54d8] xchk_rmapbt_check_unwritten_in_keyflags+0xb8/0x160 [xfs]
> 
> Use get_unaligned() for the high key.
> 
> Fixes: 38384569a2a8 ("xfs: detect unwritten bit set in rmapbt node block keys")
> Reported-by: Jan Engelhardt <jengelh@inai.de>
> Closes: https://github.com/sparclinux/issues/issues/115
> Cc: stable@vger.kernel.org # v6.4+
> Signed-off-by: Stian Halseth <stian@itx.no>
> ---
> Tested on sparc64 (T4, 7.3.3) by scrubbing the rmapbt of a loop-mounted
> image: alignment faults per scrub went from about 4000 to 0.
> 
>  fs/xfs/scrub/rmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/scrub/rmap.c b/fs/xfs/scrub/rmap.c
> index 68e2847c962bb..d0578800f3e41 100644
> --- a/fs/xfs/scrub/rmap.c
> +++ b/fs/xfs/scrub/rmap.c
> @@ -174,7 +174,7 @@ xchk_rmapbt_check_unwritten_in_keyflags(
>  			}
>  
>  			hkey = xfs_btree_high_key_addr(cur, ptr, keyblock);
> -			if (hkey->rmap.rm_offset & badflag) {
> +			if (get_unaligned(&hkey->rmap.rm_offset) & badflag) {
>  				xchk_btree_set_preen(sc, cur, level);
>  				break;
>  			}

That just looks wrong to begin with. Decoding an on-disk structure
without using be64_to_cpu() to get it in the correct endian order
first?

Oh... the code plays "I'm too smart for my own good" micro-
optimisation games by endian swapping the badflag variable to avoid
needing to endian swap the rm_offset field.

It seems to me that the correct fix here is to stop endian swapping
the badflag variable, and endian swap the rmap.rm_offset fetches for
both the low key and high keys, like all the other places that
dereference rmap.rm_offset direct from pointers returned by
xfs_btree_key_addr()/xfs_btree_high_key_addr().

Cheers,

Dave.
-- 
Dave Chinner
dgc@kernel.org