[PATCH v2] ubifs: fix host inode TNC offset when deleting an xattr

[Zhihao Cheng]

在 2026/10/13 13:29, Nan Lin 写道:
> ubifs_jnl_delete_xattr() writes a group of three nodes: the xent, the
> xattr inode and the host inode. The host inode is packed at
> xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ, but its TNC position is
> computed backwards as xent_offs + len - hlen. Since len includes the
> group's tail padding, ALIGN(hlen, 8) - hlen, the two differ whenever
> the host inode's inline data length is not a multiple of 8. This
> affects symlinks and device nodes.
> 
> The unaligned offset ends up in the on-flash index and the next mount
> rejects the index node, turning the filesystem read-only.
> 
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Cc: stable at vger.kernel.org
> Tested-by: Zhihao Cheng <chengzhihao1 at huawei.com>
> Signed-off-by: Nan Lin <lin.nan at h3c.com>
> 
> Changes since v1:
>   - compute the host inode offset into a new host_offs variable instead
>     of open-coding the offset (Richard Weinberger);
>   - shorten the commit message.
> 
> ---
>   fs/ubifs/journal.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)

Reviewed-by: Zhihao Cheng <chengzhihao1 at huawei.com>
> 
> diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
> index 40a95a2fad50..0b2dae57e467 100644
> --- a/fs/ubifs/journal.c
> +++ b/fs/ubifs/journal.c
> @@ -1858,7 +1858,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
>   			   const struct inode *inode,
>   			   const struct fscrypt_name *nm)
>   {
> -	int err, xlen, hlen, len, lnum, xent_offs, aligned_xlen, write_len;
> +	int err, xlen, hlen, len, lnum, xent_offs, host_offs, aligned_xlen,
> +		write_len;
>   	struct ubifs_dent_node *xent;
>   	struct ubifs_ino_node *ino;
>   	union ubifs_key xent_key, key1, key2;
> @@ -1915,6 +1916,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
>   		ubifs_wbuf_add_ino_nolock(&c->jheads[BASEHD].wbuf, host->i_ino);
>   	release_head(c, BASEHD);
>   
> +	host_offs = xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ;
> +
>   	ubifs_add_auth_dirt(c, lnum);
>   	kfree(xent);
>   	if (err)
> @@ -1943,7 +1946,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
>   
>   	/* And update TNC with the new host inode position */
>   	ino_key_init(c, &key1, host->i_ino);
> -	err = ubifs_tnc_add(c, &key1, lnum, xent_offs + len - hlen, hlen, hash);
> +	err = ubifs_tnc_add(c, &key1, lnum, host_offs, hlen, hash);
>   	if (err)
>   		goto out_ro;
>   
>