Commit c06c303832ec for kernel

commit c06c303832ecd5edef90c6817a6eb0eb7fed7a64
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Dec 6 15:28:11 2025 -0800

    ocfs2: fix xattr array entry __counted_by error

    Commit 2f26f58df041 ("ocfs2: annotate flexible array members with
    __counted_by_le()") started annotating the flexible arrays used by
    ocfs2, and now gcc complains about ocfs2_reflink_xattr_header():

      In function ‘fortify_memset_chk’,
          inlined from ‘ocfs2_reflink_xattr_header’ at fs/ocfs2/xattr.c:6365:5:
      include/linux/fortify-string.h:480:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]

    and it looks like the complaint is valid - even if the actual error
    message is somewhat confusing.

    The 'last' pointer points to past the end of the counted flex array, but
    is used as an actual 'last' entry rather than a 'one-past-last'.

    It looks like the code copied and cleared an extra entry (which is
    likely harmless in practice), but I don't know ocfs2 at all.  Because
    it's also possible that the counted-by annotations are off-by-one, and
    so this needs checking by somebody who actually knows ocfs2.

    But in the meantime this fixes the build error, and certainly _looks_
    sane.

    Cc: Dmitry Antipov <dmantipov@yandex.ru>
    Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
    Cc: Heming Zhao <heming.zhao@suse.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 73c028f452ac..dc1761e84814 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -6351,7 +6351,7 @@ static int ocfs2_reflink_xattr_header(handle_t *handle,
 	trace_ocfs2_reflink_xattr_header((unsigned long long)old_bh->b_blocknr,
 					 le16_to_cpu(xh->xh_count));

-	last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)];
+	last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)] - 1;
 	for (i = 0, j = 0; i < le16_to_cpu(xh->xh_count); i++, j++) {
 		xe = &xh->xh_entries[i];