Linux kernel XFS vulnerabilities

In the Linux kernel, XFS exchange-range operations incorrectly moved the reflink flag between files even though a file can still own shared blocks beyond i_disk_size. This caused in-place writes instead of CoW, corrupting the other file sharing those blocks. The fix stops moving the flags and sets them on both inodes, including for XFS_IOC_SWAPEXT.

A bug was fixed in the Linux kernel's XFS involving the XFS_IOC_EXCHANGE_RANGE operation with the TO_EOF flag. Incorrect swapping of file sizes at nonzero offsets caused a file to have shared blocks beyond EOF, and subsequently the reflink flag was incorrectly cleared, allowing a shared block to be overwritten.

A vulnerability in the Linux kernel's XFS filesystem causes under-reservation of blocks when repairing shortform directories. Incorrectly setting args->total to 1 instead of the actual directory block count (fsbcount) triggers an assertion failure and can lead to a filesystem shutdown.

A vulnerability in the Linux kernel's XFS filesystem causes incorrect l_iclog_roundoff values (512 instead of expected 4096) when the superblock lacks a log stripe unit, leading to corrupted logs and unmountable filesystems. This occurs on disks with 4k physical sectors.