OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.
A corrupted slot can therefore index osb_orphan_wipes or the slot-local
system-inode cache outside their allocations before the corruption is
reported.

Patch 1 validates the ordinary orphan slot used by inode wipe processing.
Patch 2 validates the append-DIO orphan slot used by DIO completion and
orphan recovery.  Both checks reject corrupt metadata at the existing inode
validation boundary.

ZhengYuan Huang (2):
  ocfs2: validate orphan slot during inode read
  ocfs2: validate DIO orphan slot during inode read

Signed-off-by: ZhengYuan Huang <gality369@gmail.com>

 fs/ocfs2/inode.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

-- 
2.43.0

On Mon,  3 Aug 2026 11:00:05 +0800 ZhengYuan Huang <gality369@gmail.com> wrote:

> OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.
> A corrupted slot can therefore index osb_orphan_wipes or the slot-local
> system-inode cache outside their allocations before the corruption is
> reported.

Thanks.  AI review raised several possible issues, all pre-existing. 
"out of bound access", "crash the kernel", "out-of-bounds heap access",
"triggering this crash", etc.  All the usual things (seriously!).

	https://sashiko.dev/#/patchset/20260803030007.3993199-1-gality369@gmail.com

None of which stands in the way of your fixes.

The best I can do with this onslaught is to make maintainers aware then
move on.

I do wish that Sashiko was more organized about these drive-by bug
reports.  Retain them in some lookable-uppable way for maintainers to
look at when they have time.  This has been suggested to the Sashiko
developers.  Perhaps one day...

On 8/5/26 4:41 AM, Andrew Morton wrote:
> On Mon,  3 Aug 2026 11:00:05 +0800 ZhengYuan Huang <gality369@gmail.com> wrote:
> 
>> OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.
>> A corrupted slot can therefore index osb_orphan_wipes or the slot-local
>> system-inode cache outside their allocations before the corruption is
>> reported.
> 
> Thanks.  AI review raised several possible issues, all pre-existing. 
> "out of bound access", "crash the kernel", "out-of-bounds heap access",
> "triggering this crash", etc.  All the usual things (seriously!).
> 
> 	https://sashiko.dev/#/patchset/20260803030007.3993199-1-gality369@gmail.com
> 
> None of which stands in the way of your fixes.
> 
> The best I can do with this onslaught is to make maintainers aware then
> move on.
> 
> I do wish that Sashiko was more organized about these drive-by bug
> reports.  Retain them in some lookable-uppable way for maintainers to
> look at when they have time.  This has been suggested to the Sashiko
> developers.  Perhaps one day...

Addressed in:
https://lore.kernel.org/ocfs2-devel/20260831062848.2743436-1-joseph.qi@linux.alibaba.com/T/#u

Thanks,
Joseph