From c06c303832ecd5edef90c6817a6eb0eb7fed7a64 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sat, 6 Dec 2025 15:28:11 -0800 Subject: [PATCH] ocfs2: fix xattr array entry __counted_by error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 2f26f58df041 ("ocfs2: annotate flexible array members with __counted_by_le()") started annotating the flexible arrays used by ocfs2, and now gcc complains about ocfs2_reflink_xattr_header(): In function ‘fortify_memset_chk’, inlined from ‘ocfs2_reflink_xattr_header’ at fs/ocfs2/xattr.c:6365:5: include/linux/fortify-string.h:480:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] and it looks like the complaint is valid - even if the actual error message is somewhat confusing. The 'last' pointer points to past the end of the counted flex array, but is used as an actual 'last' entry rather than a 'one-past-last'. It looks like the code copied and cleared an extra entry (which is likely harmless in practice), but I don't know ocfs2 at all. Because it's also possible that the counted-by annotations are off-by-one, and so this needs checking by somebody who actually knows ocfs2. But in the meantime this fixes the build error, and certainly _looks_ sane. Cc: Dmitry Antipov Cc: Joseph Qi Cc: Heming Zhao Cc: Andrew Morton Signed-off-by: Linus Torvalds --- fs/ocfs2/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 73c028f452ac..dc1761e84814 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -6351,7 +6351,7 @@ static int ocfs2_reflink_xattr_header(handle_t *handle, trace_ocfs2_reflink_xattr_header((unsigned long long)old_bh->b_blocknr, le16_to_cpu(xh->xh_count)); - last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)]; + last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)] - 1; for (i = 0, j = 0; i < le16_to_cpu(xh->xh_count); i++, j++) { xe = &xh->xh_entries[i];