Re: [PATCH] ocfs2: fix stale extent map cache during COW operations

[Heming Zhao <heming.zhao@suse.com>]

Hi Deepanshu,

Good catch! With following explanation, your patch looks good to me.

Thanks,
Heming

On 10/11/25 16:32, Deepanshu Kartikey wrote:
> Hi Heming,
> 
> Thank you for the detailed analysis and feedback.
> 
> After further investigation, I discovered that the ioctl call in the reproducer
> (0x40406f06) is NOT FITRIM as the syzbot comment suggested. Decoding the ioctl
> number shows:
>    - Type: 'o' (0x6f)
>    - Number: 6
>    - This is OCFS2_IOC_MOVE_EXT (defined in fs/ocfs2/ocfs2_ioctl.h:222)
> 
> So the actual call path in the reproducer is:
> 1. copy_file_range() - creates reflinked extent with flags=0x2
> 2. ioctl(OCFS2_IOC_MOVE_EXT) - calls ocfs2_move_extents() ->
>     __ocfs2_move_extents_range()
> 3. write() - triggers BUG_ON
> 
> Inside __ocfs2_move_extents_range(), the while loop:
>    - Calls ocfs2_get_clusters() which caches the extent with flags=0x2
>    - Then calls ocfs2_move_extent() -> __ocfs2_move_extent()
>    - __ocfs2_move_extent() at line 50 clears the refcount flag on disk:
>        replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
>    - But the extent cache is not invalidated
> 
> This is exactly what my v2 patch fixes by adding ocfs2_extent_map_trunc()
> after the move operation completes.
> 
> Thanks for your time!
> 
> Best regards,
> Deepanshu