ocfs2_validate_dx_root() does not verify dr_fs_generation against the
superblock generation, unlike the extent and xattr block validators
which check h_fs_generation and xb_fs_generation respectively.  The
field is documented as "Must match super block".

Without the check, a stale dir index root block left on the device from
a previously formatted filesystem at the same physical block number can
pass validation as long as its signature, dr_blkno and checksum match.
Its index entries and suballocator information would then be used in
the new filesystem context.

Reject dir index root blocks whose dr_fs_generation does not match the
mounted filesystem, like the extent and xattr block validators do.

Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
---
 fs/ocfs2/dir.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 6bb6aa133f01..329680b46227 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -613,6 +613,14 @@ static int ocfs2_validate_dx_root(struct super_block *sb,
 		goto bail;
 	}
 
+	if (le32_to_cpu(dx_root->dr_fs_generation) != OCFS2_SB(sb)->fs_generation) {
+		ret = ocfs2_error(sb,
+				  "Dir Index Root # %llu has an invalid dr_fs_generation of #%u\n",
+				  (unsigned long long)bh->b_blocknr,
+				  le32_to_cpu(dx_root->dr_fs_generation));
+		goto bail;
+	}
+
 	/*
 	 * Dir index root blocks are allocated from a per-slot suballocator,
 	 * so the slot must be in range.  Otherwise removing the index passes
-- 
2.39.3

On Fri, Sep 04, 2026 at 07:15:51PM +0800, Joseph Qi wrote:
> ocfs2_validate_dx_root() does not verify dr_fs_generation against the
> superblock generation, unlike the extent and xattr block validators
> which check h_fs_generation and xb_fs_generation respectively.  The
> field is documented as "Must match super block".
> 
> Without the check, a stale dir index root block left on the device from
> a previously formatted filesystem at the same physical block number can
> pass validation as long as its signature, dr_blkno and checksum match.
> Its index entries and suballocator information would then be used in
> the new filesystem context.
> 
> Reject dir index root blocks whose dr_fs_generation does not match the
> mounted filesystem, like the extent and xattr block validators do.
> 
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>

LGTM.
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
> ---
>  fs/ocfs2/dir.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
> index 6bb6aa133f01..329680b46227 100644
> --- a/fs/ocfs2/dir.c
> +++ b/fs/ocfs2/dir.c
> @@ -613,6 +613,14 @@ static int ocfs2_validate_dx_root(struct super_block *sb,
>  		goto bail;
>  	}
>  
> +	if (le32_to_cpu(dx_root->dr_fs_generation) != OCFS2_SB(sb)->fs_generation) {
> +		ret = ocfs2_error(sb,
> +				  "Dir Index Root # %llu has an invalid dr_fs_generation of #%u\n",
> +				  (unsigned long long)bh->b_blocknr,
> +				  le32_to_cpu(dx_root->dr_fs_generation));
> +		goto bail;
> +	}
> +
>  	/*
>  	 * Dir index root blocks are allocated from a per-slot suballocator,
>  	 * so the slot must be in range.  Otherwise removing the index passes
> -- 
> 2.39.3
>