[PATCH] ocfs2: avoid moving extents to occupied clusters

[PATCH] ocfs2: avoid moving extents to occupied clusters

[Kyle Zeng]

For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a
physical me_goal.  ocfs2_move_extent() initializes new_phys_cpos from
that goal and expects ocfs2_probe_alloc_group() to replace it with a
free run in the target block group.

The probe currently leaves *phys_cpos unchanged if the scan reaches the
end of the group without finding a free run.  An occupied goal at the
last bit can therefore survive the probe and be passed to
__ocfs2_move_extent(), which copies file data into a cluster still owned
by another inode before the bitmap is updated.

When the probe does find a free run, it also subtracts move_len from the
ending bit.  The start of an N-bit run ending at i is i - N + 1, so the
current calculation can report the bit immediately before the free run.

Clear *phys_cpos before scanning and use the correct free-run start.
Callers already treat a zero result as -ENOSPC, so failed probes no
longer continue with an occupied caller-controlled goal.

Fixes: e6b5859cccfa ("Ocfs2/move_extents: helper to probe a proper region to move in an alloc group.")
Fixes: 236b9254f8d1 ("ocfs2: fix non-auto defrag path not working issue")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/ocfs2/move_extents.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index c53de4439d93..ad1678ee7cc4 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -534,6 +534,8 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh,
 	u32 base_cpos = ocfs2_blocks_to_clusters(inode->i_sb,
 						 le64_to_cpu(gd->bg_blkno));
 
+	*phys_cpos = 0;
+
 	for (i = base_bit; i < le16_to_cpu(gd->bg_bits); i++) {
 
 		used = ocfs2_test_bit(i, (unsigned long *)gd->bg_bitmap);
@@ -555,7 +557,7 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh,
 			last_free_bits++;
 
 		if (last_free_bits == move_len) {
-			i -= move_len;
+			i = i - move_len + 1;
 			*goal_bit = i;
 			*phys_cpos = base_cpos + i;
 			break;
-- 
2.51.0

Re: [PATCH] ocfs2: avoid moving extents to occupied clusters

[Joseph Qi]

On 6/12/26 5:35 AM, Kyle Zeng wrote:
> For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a
> physical me_goal.  ocfs2_move_extent() initializes new_phys_cpos from
> that goal and expects ocfs2_probe_alloc_group() to replace it with a
> free run in the target block group.
> 
> The probe currently leaves *phys_cpos unchanged if the scan reaches the
> end of the group without finding a free run.  An occupied goal at the
> last bit can therefore survive the probe and be passed to
> __ocfs2_move_extent(), which copies file data into a cluster still owned
> by another inode before the bitmap is updated.
> 
> When the probe does find a free run, it also subtracts move_len from the
> ending bit.  The start of an N-bit run ending at i is i - N + 1, so the
> current calculation can report the bit immediately before the free run.
> 
> Clear *phys_cpos before scanning and use the correct free-run start.
> Callers already treat a zero result as -ENOSPC, so failed probes no
> longer continue with an occupied caller-controlled goal.
> 
> Fixes: e6b5859cccfa ("Ocfs2/move_extents: helper to probe a proper region to move in an alloc group.")
> Fixes: 236b9254f8d1 ("ocfs2: fix non-auto defrag path not working issue")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Looks fine.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> ---
>  fs/ocfs2/move_extents.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
> index c53de4439d93..ad1678ee7cc4 100644
> --- a/fs/ocfs2/move_extents.c
> +++ b/fs/ocfs2/move_extents.c
> @@ -534,6 +534,8 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh,
>  	u32 base_cpos = ocfs2_blocks_to_clusters(inode->i_sb,
>  						 le64_to_cpu(gd->bg_blkno));
>  
> +	*phys_cpos = 0;
> +
>  	for (i = base_bit; i < le16_to_cpu(gd->bg_bits); i++) {
>  
>  		used = ocfs2_test_bit(i, (unsigned long *)gd->bg_bitmap);
> @@ -555,7 +557,7 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh,
>  			last_free_bits++;
>  
>  		if (last_free_bits == move_len) {
> -			i -= move_len;
> +			i = i - move_len + 1;
>  			*goal_bit = i;
>  			*phys_cpos = base_cpos + i;
>  			break;