Re: [PATCH] xfs: fix spurious len double-counting in rmap three-way merge check

[Carlos Maiolino <cem@kernel.org>]

On Tue, Nov 03, 2026 at 10:41:44PM +0800, jianyungao89@gmail.com wrote:
> From: Jianyun Gao <jianyungao89@gmail.com>
> 
> In xfs_rmap_map, the left-edge merge path already executes
> ltrec.rm_blockcount += len at line 1119 before checking whether the
> right record is also contiguous and can be merged.  The subsequent
> overflow guard therefore must compare the already-incremented
> ltrec.rm_blockcount plus gtrec.rm_blockcount against XFS_RMAP_LEN_MAX,
> but it incorrectly adds len a second time:
> 
> (unsigned long)ltrec.rm_blockcount + len +
>    gtrec.rm_blockcount <= XFS_RMAP_LEN_MAX
> 
> The extra len makes the check too strict: when the real merged length
> does not overflow but the inflated value exceeds XFS_RMAP_LEN_MAX, the
> three-way merge is rejected and the code falls back to a two-way merge,
> leaving the right record unmerged.  This produces rmap btree
> fragmentation but does not corrupt on-disk metadata.
> 
> Remove the spurious len from the overflow check.
> 
> Fixes: 0a1b0b3855cf7 ("xfs: add an extent to the rmap btree")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>

Hi, even though this looks reasonably correct, how did you find this
issue?
Did you test this at all against any regressions (i.e. running it
against xfstests)? This is touching critical logic on the rmap trees
which can potentially end really bad.

Cheers.

> ---
>  fs/xfs/libxfs/xfs_rmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
> index 14aef87837a9..c2b2f8e7502d 100644
> --- a/fs/xfs/libxfs/xfs_rmap.c
> +++ b/fs/xfs/libxfs/xfs_rmap.c
> @@ -1120,7 +1120,7 @@ xfs_rmap_map(
>  		if (have_gt &&
>  		    bno + len == gtrec.rm_startblock &&
>  		    (ignore_off || offset + len == gtrec.rm_offset) &&
> -		    (unsigned long)ltrec.rm_blockcount + len +
> +		    (unsigned long)ltrec.rm_blockcount +
>  				gtrec.rm_blockcount <= XFS_RMAP_LEN_MAX) {
>  			/*
>  			 * right edge also contiguous, delete right record
> -- 
> 2.34.1
> 
>