Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] fs/dax: out-of-bounds length and size calculations in dax_range_compare_iter() --
commit 01ad9c7e5da5c800a76808134a31ff80911b589c Author: Jianyun Gao <[email protected]> dax: fix wrong error code returned from dax_dedupe_file_range_compare() When dax_range_compare_iter() returns a negative error code (e.g. -EIO), dax_dedupe_file_range_compare() incorrectly returns ret which holds the positive return value from iomap_iter() indicating more iterations remain. This positive value leaks to the caller, where vfs_dedupe_file_range() interprets it as success, causing userspace to incorrectly believe deduplication completed. > diff --git a/fs/dax.c b/fs/dax.c > index 08adeaed2baf1..97b6212bfa898 100644 > --- a/fs/dax.c > +++ b/fs/dax.c > @@ -2254,7 +2254,7 @@ int dax_dedupe_file_range_compare(struct inode *src, > loff_t srcoff, > status = dax_range_compare_iter(&src_iter, &dst_iter, > min(src_iter.len, dst_iter.len), same); > if (status < 0) > - return ret; > + return status; [Severity: High] Does propagating this error code expose latent out-of-bounds calculations in dax_range_compare_iter()? Inside dax_range_compare_iter(), the length is incorrectly clamped using the total extent length rather than the remaining mapped length: fs/dax.c:dax_range_compare_iter() { ... len = min(len, min(smap->length, dmap->length)); ... } If the file offset is inside the extent and the requested length is large, len will exceed the valid remaining mapped length. This directly triggers a WARN_ON_ONCE(count > iomap_length(iter)) in iomap_iter_advance() and aborts with -EIO. Additionally, when calling dax_iomap_direct_access(), the size calculation uses the absolute file offset instead of a page offset: fs/dax.c:dax_range_compare_iter() { ... ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE), &saddr, NULL); ... } Since pos1 is an absolute file offset, for large file offsets this massive size exceeds the physical device bounds, causing dax_iomap_direct_access() to fail with -EINVAL. Now that the error code is correctly propagated, will these calculations actively cause dedupe operations to fail? > src_iter.status = dst_iter.status = status; > } > return ret; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
