Re: [PATCH] cve: reproducer for cve-2026-64600

Hi Andrea,

> From: Andrea Cervesato <andrea.cervesato-IBi9RG/[email protected]>

> Reproducer for CVE-2026-64600 ("RefluXFS"), a race condition in the XFS
> reflink copy-on-write path for direct I/O writes. The bug was introduced
> in kernel v4.11 by commit 3c68d44a2b49 ("xfs: allocate direct I/O COW
> blocks in iomap_begin") and fixed by commit 2f4acd0fcd86 ("xfs: resample
> the data fork mapping after cycling ILOCK").

Agree with Cyril's points (move to testcases/cve/reflux-xfs.c, mkfs.xfs ;
reflink arg, add missing license).

Generally LGTM. I haven't inspected the fix details (I suppose it's not based on
any existing reproducer).

...
> +static void cleanup(void)
> +{
> +	stop_pressure_threads();
> +	restore_privileges();

nit: why do we need to restore privileges? Cleanup should work without it and
then the test exits.

Kind regards,
Petr

> +
> +	if (barrier_initialized)
> +		SAFE_PTHREAD_BARRIER_DESTROY(&barrier);
> +
> +	if (target_dio_fd != -1)
> +		SAFE_CLOSE(target_dio_fd);
> +
> +	if (target_fd != -1)
> +		SAFE_CLOSE(target_fd);
> +
> +	if (clone_fd != -1)
> +		SAFE_CLOSE(clone_fd);
> +
> +	free(tbuf);
> +	free(wbuf);
> +	free(rbuf);
> +}

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp