From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 784F937AA6A for ; Fri, 17 Jul 2026 19:24:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784316269; cv=none; b=RG2ZZGJ4s04AMuc9B9scs343q293YSVayrd6RZj/VWi9y90vLo+4g1QGGHjV+omn7cq1qd3KfLwoBLPO8QnK2Lu/XE+x7/rB4LWpB7ySILImaHaiurKQe6/VbpF3w7hbAvTKu2C97ebPzNwazYeJmK+TT3J4wYrBvg9WzT7WP0k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784316269; c=relaxed/simple; bh=KeKC7n/oTJyTV63b3Kr+tQ3oG2a+u/DbbZq9QhNw8gw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=frMl7NNfWxDC7jFohExgO0EPtdUuv7ohEpSJp7513AgQcF7/FBchpKwEnz6D6yevedWlgH8JvR9vnqQ//m2d5FcCT+v9EP/QTWTuOOBxsO9iZghjsb+TeIZFdUiZZhj9/hH77qmGRJ6+C8sOS0PkdCLgHxhRTHA6DGEVd37oEKA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=tE6YSNYf; arc=none smtp.client-ip=209.85.215.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="tE6YSNYf" Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-cb5a6aa8760so321005a12.1 for ; Fri, 17 Jul 2026 12:24:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784316268; x=1784921068; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UidqxNP5YgqeCULD9zL1DJ+TVbEY7ph+loZhp7Vlg48=; b=tE6YSNYfWKI6rzcWfv3HKWfx0kWoOi1SpLlxtEDg6BJIOC1zHMw8K7BTgoYJmJY7DU iZVpWdLLU706WKxzqYdnb7EyLnyZp33v6gbxIEG2DzPOgLcnCNBv7lrDxlRcTnnwof/w pgznmIc8UPf8WlB1TcUEBGatTYMnsqlY7T74iVZFOLiZ5v/x97c+VgLDgKy7hLR/YKkW 2lkJPKQvOpq+Ldh6Id4FDVpLOkbHhse29m+gNb66dnIUyVnUh9trRg9jgN3fANNcQaGY 3Vxy7UUT2RX9BCBkNwzN/7MJaUqr724xnkymD0sPYMlcwTGR3hydLohm9kFaeMNWxx/E WvNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784316268; x=1784921068; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UidqxNP5YgqeCULD9zL1DJ+TVbEY7ph+loZhp7Vlg48=; b=gkn/10Szr7Xk3ALknGiavyZ/5+Kv4KSELsnGK5fMusTz6tfpWe90NhwvYLSy9EtbkD 77aaP5cqLviQj13ZZTCl56XZi1RVS3/0X7ME/91RsUSUMbaPx4jb+OCQQM4xwEUm/NKg Irz++SVgXuP7YxiajtSDtmdIWtzWWi25RqrqTzbMXqDUPM9+iage6yEdnGCx+Qqrz7S3 YHtg5f8DfHTrxfPGmK0UA9P3GLTMWus+APbMKp+snmRtDrGLlFqVXzollBTdbypk7xNQ SbUXNE4CTGkCUHrCo4Yt1Ftj7Qkhga0XVWOgSUBqDkEyk6VX+n+YuR0RMxBDeyqZzMlH NE0Q== X-Forwarded-Encrypted: i=1; AHgh+Rr87IL3clS2kJKizEI/qg0OmhOLKbZWaId076iDF/HoqLl25INCZ0KIZ7/NY6oG3Prhz3vPLADYXKcvLqo=@vger.kernel.org X-Gm-Message-State: AOJu0YykBTwLMP3IzTVm8kMGMFmbSvg7g5lrWKWF3L6LOPqEr4I7wtdW Y10X8xXVxUY3p/bbk0JeB/wP14R/w+zwZNZcZOEsoRseoqSQlYuuumee X-Gm-Gg: AfdE7cnY5uJJlnGN9bmQuZ1gknKUf33PsvfqC0kA+1oHrQ4/CcJZllvlqAqXH9Br+YP qUjQqRUrx8DbzgQuMP8c5XQmoOsHTTMySJ31+if619lbRdv3a6e8EIJqWdsnUYGRktcdVqZKBT+ Xdm+gzA8OdP6k1oAO96EpYTz4JIkUg4VunYZLx7iCP2rfU/i01vvcYKph0hyCN3XQu9vNf1dRnA ct09zUL4J6TXWgzv312vLoYcdNIoNx8bjgi6Pqs5YdxJaNUt0geV3exq+MLsCH35HPKp2zzo/Jo j6H0ohzwyURi5GMwF//HpJZXlhMc900ExNidMlk1CG9P0iWf6Q575cFMVtwlORklio6iuQHTbUR qRhH/PbyJju0IiODGoEaIz8bilcEDejdiQR53z7ZxoGlbOSUfY6ytL2asPdq6b1UxwX1P1GM/Gn 58z5TtV0FgszVl8g+M82bEreQjkd99nt2BZcWuQDqFYBlXAIg= X-Received: by 2002:a17:90b:264b:b0:387:e0db:bc24 with SMTP id 98e67ed59e1d1-38e4b555d20mr3795621a91.36.1784316267848; Fri, 17 Jul 2026 12:24:27 -0700 (PDT) Received: from fx.tailc0aff1.ts.net ([206.206.192.132]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3142a1dde81sm18648783eec.21.2026.07.17.12.24.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 12:24:27 -0700 (PDT) From: Weiming Shi To: Carlos Maiolino , "Darrick J . Wong" Cc: linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org, xmei5@asu.edu, Weiming Shi , Dave Chinner Subject: [PATCH v2 1/2] xfs: reject log items with missing regions during recovery Date: Fri, 17 Jul 2026 12:24:07 -0700 Message-ID: <20260717192408.109168-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717192408.109168-1-bestswngs@gmail.com> References: <20260717192408.109168-1-bestswngs@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Each recovered log item is assembled in xlog_recover_add_to_trans() into an ri_buf[] of ri_total (= the format's declared region count) slots, and the regions actually logged are counted in ri_cnt. Nothing checks that ri_cnt reached ri_total once the transaction is complete, so a crafted or truncated log can present an item whose format declares more regions than were logged. The trailing ri_buf[] slots are then NULL, and the reorder, readahead and replay code dereference them. For example, an XFS_LI_INODE item declaring two regions but logging only the format region leaves ri_buf[1] NULL, and mount-time recovery faults dereferencing it as the log dinode: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: xlog_recover_inode_commit_pass2 (fs/xfs/xfs_inode_item_recover.c:370) Call Trace: xlog_recover_items_pass2 (fs/xfs/xfs_log_recover.c:2011) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2078) xlog_recovery_process_trans (fs/xfs/xfs_log_recover.c:2328) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2502) xlog_recover (fs/xfs/xfs_log_recover.c:3486) xfs_log_mount (fs/xfs/xfs_log.c:667) xfs_mountfs (fs/xfs/xfs_mount.c:1039) xfs_fs_fill_super (fs/xfs/xfs_super.c:1965) get_tree_bdev_flags (fs/super.c:1680) __x64_sys_mount (fs/namespace.c:4433) Whether an item logged all its declared regions is a generic log format property, not a per-item-type concern, so reject any item with a missing region in xlog_recover_commit_trans() before the item ops run. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Xiang Mei Suggested-by: Dave Chinner Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi --- fs/xfs/xfs_log_recover.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index 09e6678ca487..5250d512a392 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2039,6 +2039,17 @@ xlog_recover_commit_trans( hlist_del_init(&trans->r_list); + /* + * Reject an item missing a region its format declared; the NULL slot + * would be dereferenced by the reorder and replay code. + */ + list_for_each_entry(item, &trans->r_itemq, ri_list) { + if (XFS_IS_CORRUPT(log->l_mp, + item->ri_total == 0 || + item->ri_cnt != item->ri_total)) + return -EFSCORRUPTED; + } + error = xlog_recover_reorder_trans(log, trans, pass); if (error) return error; -- 2.43.0