DF-3176

ext2_update clears IN_MODIFIED/IN_LAZYMOD/IN_LAZYACCESS before attempting the write — dirty inode state silently lost on I/O error

Summary

ext2_update clears the inode's dirty flags at :81 before bread (:85) or ext2_i2ei (:91) can fail; on either error path the pending metadata changes (size, times, block pointers) are dropped from memory and never retried - the modification silently lost while the caller believes the update was issued. ext2_reclaim's non-INVARIANTS path (:545) only re-checks IN_LAZYMOD, so on production kernels the loss is invisible. Metadata-integrity on persistent I/O error (failing disk/USB mount); no kernel-memory impact. Inherited verbatim from ffs_update - cross-fs upstream family, filed for the ext2 record. Fix: move the flag-clear after the successful write enqueue or restore flags on the error paths. [VERIFIED pass2: flags cleared before bread can fail confirmed; error-path restore compiled]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — filesystems
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-754
File: sys/vfs/ext2fs/ext2_inode.c
Lines: 79-97
Area: vfs
Discovered: 2026-09-07
Updated: 2026-09-07

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:03
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:03
Runtime: —
Kernel: per-fix-DF-3176
fix.diff: findings/poc/DF-3176/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3176 · 4 files

File	Type	Size
README.md	—	229 B	↓ raw
fix.diff	—	974 B	view raw
manifest.json	—	392 B	view raw
verdict.json	—	1.5 KB	view raw

README.md

↓ download raw

DF-3176 evidence pack

What

ext2_update clears dirty flags before the write can fail

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-3176

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - requires persistent I/O failure

Verified recommended fix

restore the dirty inode flags on the bread/ext2_i2ei error paths

Verdict

Line-accurate confirmation; no runtime demonstration attempted (requires a failing underlying device). ext2_update clears IN_LAZYACCESS|IN_LAZYMOD|IN_MODIFIED at ext2_inode.c:81 before bread (:85) or ext2_i2ei (:91) can fail; on either error the pending metadata changes are dropped and never retried, and ext2_reclaims production path only re-checks IN_LAZYMOD. Fix saves the flags and restores them on both error paths; compiled in the F40FIX build (EXT2FS in kernel).