Hi Brian,
You're right, the bug was actually introduced in 0e79e3736d54("fsdax:
dedupe: iter two files at the same time"), not the rename commit. I
will fix the Fixes tag in the next version.
Thanks for catching this!
Best regards,
Jianyun
On Wed, Oct 14, 2026 at 8:45 PM Brian Foster <[email protected]> wrote:
>
> On Mon, Oct 12, 2026 at 10:49:24PM +0800, [email protected] wrote:
> > From: Jianyun Gao <[email protected]>
> >
> > When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
> > dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
> > positive return value from iomap_iter() indicating more iterations remain.
> > This positive value leaks to the caller, where vfs_dedupe_file_range()
> > interprets it as success (bytes_deduped = len), causing userspace to
> > incorrectly believe deduplication completed.
> >
> > Return 'status' instead to propagate the actual error code.
> >
> > Fixes: 39eb05112987 ("dax: advance the iomap_iter on dedupe range")
>
> Hmm.. the patch looks fine to me, but the above commit basically just
> renamed compared to status in this function. I.e. before that commit we
> did:
>
> if (compared < 0)
> return ret;
>
> ... which seems to me has the same problem. So I'm a little curious if
> either the Fixes: is wrong, or I'm just missing something..?
>
> Brian
>
> > Cc: [email protected]
> > Signed-off-by: Jianyun Gao <[email protected]>
> > Reviewed-by: Jan Kara <[email protected]>
> > ---
> >
> > Changes in v2:
> > - Add Fixes tag and Cc stable
> > - Add Reviewed-by tag from Jan Kara
> >
> > v1: Link:
> > https://lore.kernel.org/lkml/[email protected]/
> >
> > fs/dax.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/fs/dax.c b/fs/dax.c
> > index 6ba50142eeb2..1f6a4fbb97bd 100644
> > --- a/fs/dax.c
> > +++ b/fs/dax.c
> > @@ -2261,7 +2261,7 @@ int dax_dedupe_file_range_compare(struct inode *src,
> > loff_t srcoff,
> > status = dax_range_compare_iter(&src_iter, &dst_iter,
> > min(src_iter.len, dst_iter.len), same);
> > if (status < 0)
> > - return ret;
> > + return status;
> > src_iter.status = dst_iter.status = status;
> > }
> > return ret;
> > --
> > 2.34.1
> >
>
