tplink_xx230v/kernel
2
0
Fork 0
Code Issues 3 Pull Requests 1 Projects 1 Activity
Files
airoha_en7523_eth
kernel/fs/ocfs2
History
Deepanshu Kartikey bb69928ed5 ocfs2: clear extent cache after moving/defragmenting extents 
commit 78a63493f8e352296dbc7cb7b3f4973105e8679e upstream.

The extent map cache can become stale when extents are moved or
defragmented, causing subsequent operations to see outdated extent flags.
This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:
1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
2. ioctl(FITRIM) triggers ocfs2_move_extents()
3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent()
   which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
5. The extent map cache is not invalidated after the move
6. Later write() operations read stale cached flags (0x2) but disk has
   updated flags (0x0), causing a mismatch
7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag
operation in __ocfs2_move_extents_range().  This ensures subsequent
operations read fresh extent data from disk.

Link: https://lore.kernel.org/all/20251009142917.517229-1-kartikey406@gmail.com/T/
Link: https://lkml.kernel.org/r/20251009154903.522339-1-kartikey406@gmail.com
Fixes: 53069d4e76 ("Ocfs2/move_extents: move/defrag extents within a certain range.")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reported-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com
Tested-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=2959889e1f6e216585ce522f7e8bc002b46ad9e7
Reviewed-by: Mark Fasheh <mark@fasheh.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-29 14:08:57 +01:00
..
cluster
introduce fd_file(), convert all accessors to it.
2024-08-12 22:00:43 -04:00
dlm
ocfs2: remove redundant assignment to variable status
2024-05-08 08:41:27 -07:00
dlmfs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
acl.c
ocfs2: convert to new timestamp accessors
2023-10-18 14:08:24 +02:00
acl.h
fs: port ->set_acl() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
alloc.c
ocfs2: validate l_tree_depth to avoid out-of-bounds access
2025-04-10 14:39:24 +02:00
alloc.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
aops.c
ocfs2: fix uninit-value in ocfs2_get_block()
2024-09-26 14:01:45 -07:00
aops.h
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
2024-12-05 14:02:13 +01:00
blockcheck.c
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
blockcheck.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
buffer_head_io.c
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
2024-09-09 15:15:54 -07:00
buffer_head_io.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
dcache.c
ocfs2_find_match(): there's no such thing as NULL or negative ->d_parent
2023-12-21 12:53:30 -05:00
dcache.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
dir.c
ocfs2: check dir i_size in ocfs2_find_entry
2025-02-17 10:05:48 +01:00
dir.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
dlmglue.c
ocfs2: update seq_file index in ocfs2_dlm_seq_next
2024-12-14 20:03:31 +01:00
dlmglue.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
export.c
ocfs2: fix sparse warnings
2024-04-25 21:07:04 -07:00
export.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
extent_map.c
ocfs2: fix recursive semaphore deadlock in fiemap call
2025-09-19 16:35:45 +02:00
extent_map.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
file.c
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
2024-12-05 14:02:13 +01:00
file.h
ocfs2: store cookie in private data
2024-09-12 11:58:44 +02:00
filecheck.c
ocfs2: use default_groups in kobj_type
2022-01-15 16:30:24 +02:00
filecheck.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
heartbeat.c
ocfs2: fix a typo in a comment
2022-07-29 18:12:36 -07:00
heartbeat.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
inode.c
ocfs2: prevent release journal inode after journal shutdown
2025-09-09 18:58:16 +02:00
inode.h
quota: Properly annotate i_dquot arrays with __rcu
2024-02-08 12:04:59 +01:00
ioctl.c
ocfs2: update inode ctime in ocfs2_fileattr_set
2024-04-25 21:07:01 -07:00
ioctl.h
fs: port ->fileattr_set() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
journal.c
fs/ocfs2: use sleeping version of __find_get_block()
2025-05-29 11:02:00 +02:00
journal.h
ocfs2: stop quota recovery before disabling quotas
2025-05-18 08:24:54 +02:00
Kconfig
fs: add CONFIG_BUFFER_HEAD
2023-08-02 09:13:09 -06:00
localalloc.c
ocfs2: fix the space leak in LA when releasing LA
2024-12-27 14:02:18 +01:00
localalloc.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
locks.c
ocfs2: adapt to breakup of struct file_lock
2024-02-05 13:11:43 +01:00
locks.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
Makefile
…
mmap.c
fs: Convert aops->write_begin to take a folio
2024-08-07 11:33:21 +02:00
mmap.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
move_extents.c
ocfs2: clear extent cache after moving/defragmenting extents
2025-10-29 14:08:57 +01:00
move_extents.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
namei.c
ocfs2: free inode when ocfs2_get_init_inode() fails
2024-12-14 20:03:18 +01:00
namei.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
ocfs1_fs_compat.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
ocfs2_fs.h
ocfs2: improve write IO performance when fragmentation is high
2024-04-25 21:07:03 -07:00
ocfs2_ioctl.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
ocfs2_lockid.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
ocfs2_lockingver.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
ocfs2_trace.h
ocfs2: fix DIO failure due to insufficient transaction credits
2024-06-24 20:52:10 -07:00
ocfs2.h
ocfs2: stop quota recovery before disabling quotas
2025-05-18 08:24:54 +02:00
quota_global.c
ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
2025-02-08 09:57:58 +01:00
quota_local.c
ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
2025-06-19 15:32:01 +02:00
quota.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
refcounttree.c
ocfs2: reserve space for inline xattr before attaching reflink tree
2024-09-26 14:01:44 -07:00
refcounttree.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
reservations.c
ocfs2: correctly use ocfs2_find_next_zero_bit()
2024-04-25 21:07:01 -07:00
reservations.h
ocfs2: change return type of ocfs2_resmap_init
2022-04-29 14:37:58 -07:00
resize.c
ocfs2: uncache inode which has failed entering the group
2024-11-14 22:43:48 -08:00
resize.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
slot_map.c
ocfs2: Annotate struct ocfs2_slot_info with __counted_by
2023-10-02 09:48:52 -07:00
slot_map.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
stack_o2cb.c
ocfs2: constify struct ocfs2_stack_operations
2024-06-24 22:25:10 -07:00
stack_user.c
ocfs2: fix double free in user_cluster_connect()
2025-10-15 12:00:18 +02:00
stackglue.c
fs: Remove the now superfluous sentinel elements from ctl_table array
2023-12-28 04:57:57 -08:00
stackglue.h
ocfs2: constify struct ocfs2_stack_operations
2024-06-24 22:25:10 -07:00
suballoc.c
ocfs2: fix the issue with discontiguous allocation in the global_bitmap
2025-05-18 08:24:54 +02:00
suballoc.h
ocfs2: fix the issue with discontiguous allocation in the global_bitmap
2025-05-18 08:24:54 +02:00
super.c
ocfs2: stop quota recovery before disabling quotas
2025-05-18 08:24:54 +02:00
super.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
symlink.c
ocfs2: handle a symlink read error correctly
2025-02-17 10:05:39 +01:00
symlink.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
sysfile.c
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
sysfile.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
uptodate.c
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
uptodate.h
treewide: remove editor modelines and cruft
2021-05-07 00:26:34 -07:00
xattr.c
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
2024-11-07 14:14:59 -08:00
xattr.h
ocfs2: move ocfs2_xattr_handlers and ocfs2_xattr_handler_map to .rodata
2023-10-09 16:24:20 +02:00