From e5813a1e19e262e7ddb43648d8d4353433c31fa5 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Mon, 13 Jul 2026 23:03:44 -0700 Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK ANBZ: #40977 commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 upstream. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. Cc: hch@lst.de Cc: stable@vger.kernel.org # v4.11 Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino [backport-note] PatchPilot-Conflict-Type: divergent_fix, rename_refactor PatchPilot-Conflict-Files: fs/xfs/xfs_reflink.c PatchPilot-Resolution: fs/xfs/xfs_reflink.c: Take upstream if_seq resample into downstream monolithic allocate_cow; drop refactor split [Fixes conflicts by PatchPilot] Fixes: CVE-2026-64600 Assisted-by: PatchPilot Signed-off-by: Baokun Li --- fs/xfs/xfs_reflink.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c index 3023323545f4..6831c43cd1cd 100644 --- a/fs/xfs/xfs_reflink.c +++ b/fs/xfs/xfs_reflink.c @@ -491,6 +491,7 @@ xfs_reflink_allocate_cow( xfs_filblks_t count_fsb = imap->br_blockcount; struct xfs_trans *tp; int nimaps, error = 0; + unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); bool found; bool secondary_evicting = false; xfs_filblks_t resaligned; @@ -533,8 +534,21 @@ xfs_reflink_allocate_cow( *lockmode = XFS_ILOCK_EXCL; /* - * Check for an overlapping extent again now that we dropped the ilock. + * The data fork mapping may have changed while we dropped the ILOCK + * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full + * CoW cycle including xfs_reflink_end_cow(), which remaps this offset + * and drops the refcount of the old shared block). Re-read it so the + * shared-status recheck below and the caller's in-place iomap both + * operate on the current mapping rather than a stale physical block. */ + if (seq_before != READ_ONCE(ip->i_df.if_seq)) { + nimaps = 1; + error = xfs_bmapi_read(ip, imap->br_startoff, + imap->br_blockcount, imap, &nimaps, 0); + if (error) + goto out_trans_cancel; + } + error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found); if (error || !*shared) goto out_trans_cancel; -- Gitee