From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FAE323395E for ; Wed, 15 Jul 2026 00:36:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.216.47 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784075799; cv=pass; b=l0iN3R9kaE6XHMFvB6jKGQArKPTxJyrMNwwJOxFqwBjg/QwZsebUaeg9PEvpKKH181cIXinpKsYhToW87HMXILQw/nwZVBTunBU52fBhNCHJFP9IhR9jE7XFQ98PQOMQm8q92ZN1Rt2xeGu86G/tKMp3adLaf80EG6lBPLODu6M= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784075799; c=relaxed/simple; bh=IhgagwPLcErYXsbFBMm1CziaZKavTfhArRfY6nQ1Jhk=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=nSfxR/SOa4nbTPBsX8HLgIkcF0m7IkwX7wqGpFGzWVN5IDqJ2s0rWLSLY6YBAnvbySnciYhN4Co8miKNP5/Ea1pmRyW9oziHrTY85kLrizuMV5H1mQeoRPJH0/X9oG7r3f3KBYa1+uPEfNW37K2rdfjCfejqKnm2d+vOL19Y3pg= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=O2SdXwRp; arc=pass smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="O2SdXwRp" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso1715721a91.2 for ; Tue, 14 Jul 2026 17:36:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784075794; cv=none; d=google.com; s=arc-20260327; b=XFzSedRfkiaNQA+VzUd4yfF2Gtu/flOrxsZgiBu2Qc8mD1PEn19Vomyfd8TzzsVC/C l9ome3duBnZn2VHeOpmvKKbdJzf070TmMTUYyHDz14H6V69lIp+EbLbWApgD1RR0ds+1 mjrD/BozNxfVDvoESImZA/22zpOzjYdf8+IsawZ7oNklaXtj/Jkj7FjV8bFtiB96Yv5S jqghL9/7mqONL8BUaNN9Rb1JXVH6UzMB0J4MXOfAj++/ySNMmWoR4gd8PrjiX7UES9sd Ix3V3SQprlahqpKkGh7wUmN+MHDbMdiPH993wRknlyms+7rZ42zN+NU2WIcHtvBblsFD bbng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=DBldHdbR59xzOwiGY7csdK2px0Gbv1LqenTuLfbw2nY=; fh=CltfLdE3Rf+dmFrUB+qwT/o9ANa9+hJX2m/OAeWO6bw=; b=oEi24bCUtENSmXzHrfCwyqhPXJxzLmnx5jKYQojrc6mr54T9F+2Fuh7WQx9li/2aKy iyzMzwDQaDxD4MnVQnabnbvaLEEbv/oJCBNLMSlte674b41LAtmpgKHegc8wdNEL98rv pkq4kdIMWSPiOG8SFOj58Z9o9chJJJVdVLepbV3IPqc75AfJ7q+bIAS7B1VbMZmHlkJV NUQIWJwz1oI0RWpJBrsSBXk74TwTfkgr62dhuILq3OnHY9v/LPsjbte4F24dZddBk0ST rphY4xd+dFFPWtDg1p/5zw3w/yXJCdSgi8K8FLXtqtuxrA9bQlCW4Ud8pjqyT1ATNds7 1z1w==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1784075794; x=1784680594; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=DBldHdbR59xzOwiGY7csdK2px0Gbv1LqenTuLfbw2nY=; b=O2SdXwRp7ow2SHwf8WbnH69/ji+Q5s+R/c+ghhZiH6Yl2vl7dLs8hLWZkRr7V3tHyp TwcYt7xGKmk3OZDn612p/K0uqBlkQHPMX0mNIwGp430wfC1LlkHorr2UpkY5BncgPmgx oyeIASCRJ4/sp4+gWrtjJFQSs02J5bNzO4LUKPWIpT3OYXea3pGsyk7Rn8Xzq3A6Z4P3 Bxx3zz90OImwHsKzCBiA59MGdRwOw+bK9p35tYZadpyV+MhsKwDGXejEZzPuhPAbJdox 0vUq9Gtng9F1M5IluFPmLVszqNak6h+Hd15Vw1aUk54wzb0g8/mNCPwkx80krIc0WpOf 9Zig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784075794; x=1784680594; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=DBldHdbR59xzOwiGY7csdK2px0Gbv1LqenTuLfbw2nY=; b=UDHBIQE4LurUncdtWTbWxJ+JowMQ+9g0smTBIImdN4W/YAzvDUQiTwgbGFWXWIFI9u MscrTb0f8xYvZAhl+m7i71FXeOmTW6kjeN/rSgM8kYM2OihEgeOuWJU/FxLCCUhsodhM AE8dK8jXWD6/P5PJ4PGyXr8JEL1sDk2sDWl9djDECsd/3nNQp5eTD6E5DCZ8m7qJNlTR JJtCLFPWvVH7sXEywURUsH5txefiz9uQUNDofezDVo5traiQg+0xaw9EMRCvyVWtcHcW 3UuQFWu1Zb5VupmMO5sRqFxtf2+/7kUF0ldqNDxhodJg7vc/ZggSK7161NIUjnh+rL6c GWdw== X-Forwarded-Encrypted: i=1; AHgh+RrZFHkYRxsNgYCdzC0MGGoUN0+/l82Lgo2QkimxG8Pp5H/YmITJi2KucWZRmsR5dM0hIQYcGSAJexcMvLQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyoU6gaIbTmlJgIycP7sg565SWadiBaA9qvH7Dzs4vJOhw9zL7i +GMvHs3F4QZXwvWEuUbHgD+aNHmrwMh8KlKpeYypEzNp0j2DgccIqzUM+202XqSOgjOnL9HuRu2 5eDAuiWFkfC1gcDNUk7ibc4JkcNcHotmRj4yZl7ah X-Gm-Gg: AfdE7ckETZ1RD2jLRlbdTsqwCBjb9WOw+35f6yoezJFEaPUTNsftBhGr6o8NIyk9Z3e 6XKI56H2XKii4p3M6V+utezZQ9+BcrgJdlNeZQSm0yEX/PrEhO3IQkxWVcpsvj/4ACFUh7KhLk2 5IyfdxaROoaTrssHsN/RjGfJijg8rK8rAaJLRmEXTpCdSzHgAbyk2912lMwbaEjcMEUjWkypjfV vhJ+F7kwwUTHWLs12VGSkxJ0q8j05bKGRKMpreYdafAV/eJzg34SPgZ83Y5V6u1jfMrjSrEGd0S rTGwQnyVV5YpkEtNw3/en+7wa9IARVRQ25Qbumo= X-Received: by 2002:a17:90b:264b:b0:38e:79f:76c6 with SMTP id 98e67ed59e1d1-38e079f7788mr7757014a91.24.1784075793850; Tue, 14 Jul 2026 17:36:33 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260712220854.3131445-1-xmei5@asu.edu> <20260713225721.GM7195@frogsfrogsfrogs> In-Reply-To: <20260713225721.GM7195@frogsfrogsfrogs> From: Xiang Mei Date: Tue, 14 Jul 2026 17:36:22 -0700 X-Gm-Features: AUfX_mz0KzewxGrV4iSsWihDxa5m_UbpLckWgQr4KlMKsAhOyJCNkWHSUe8C0ew Message-ID: Subject: Re: [PATCH] xfs: reject log continuation for a header-only item in recovery To: "Darrick J. Wong" Cc: Carlos Maiolino , linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org, bestswngs@gmail.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jul 13, 2026 at 3:57=E2=80=AFPM Darrick J. Wong = wrote: > > On Sun, Jul 12, 2026 at 03:08:54PM -0700, Xiang Mei wrote: > > On an XLOG_WAS_CONT_TRANS op, xlog_recover_add_to_cont_trans() extends = the > > tail item's last region via item->ri_buf[item->ri_cnt-1] without checki= ng > > that the item has one. A header-only item, created by > > xlog_recover_add_to_trans() when a transaction's first op is a bare > > sizeof(struct xfs_trans_header) op carrying XFS_TRANS_HEADER_MAGIC, sit= s on > > r_itemq with ri_cnt =3D=3D 0 and ri_buf =3D=3D NULL. A crafted log whos= e ops are > > XLOG_START_TRANS, that header op, then XLOG_WAS_CONT_TRANS thus > > dereferences ((struct kvec *)NULL)[-1] and faults during mount(2) log > > recovery of an untrusted XFS image. > > > > A valid XLOG_WAS_CONT_TRANS only follows a region written with > > XLOG_CONTINUE_TRANS, so ri_cnt >=3D 1 always holds for a real log. Reje= ct the > > ri_cnt =3D=3D 0 case as corruption with -EFSCORRUPTED, which the caller= already > > propagates to abort recovery. > > > > BUG: unable to handle page fault for address: fffffffffffffff0 > > #PF: supervisor read access in kernel mode > > Oops: 0000 [#1] SMP KASAN NOPTI > > RIP: 0010:xlog_recover_add_to_cont_trans (fs/xfs/xfs_log_recover.c:21= 35) > > Call Trace: > > xlog_recovery_process_trans (fs/xfs/xfs_log_recover.c:2306) > > xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2500) > > xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3243) > > xlog_do_log_recovery (fs/xfs/xfs_log_recover.c:3331) > > xlog_do_recover (fs/xfs/xfs_log_recover.c:3368) > > xlog_recover (fs/xfs/xfs_log_recover.c:3493) > > xfs_log_mount (fs/xfs/xfs_log.c:617) > > xfs_mountfs (fs/xfs/xfs_mount.c:1031) > > xfs_fs_fill_super (fs/xfs/xfs_super.c:1940) > > get_tree_bdev_flags (fs/super.c:1634) > > vfs_get_tree (fs/super.c:1694) > > fc_mount (fs/namespace.c:1198) > > path_mount (fs/namespace.c:4161) > > __x64_sys_mount (fs/namespace.c:4367) > > do_syscall_64 (arch/x86/entry/syscall_64.c:94) > > entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) > > Kernel panic - not syncing: Fatal exception > > > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > > Reported-by: Weiming Shi > > Assisted-by: Claude:claude-opus-4-8 > > Signed-off-by: Xiang Mei > > --- > > fs/xfs/xfs_log_recover.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c > > index 5f984bf5698a..fa8e04bf1aac 100644 > > --- a/fs/xfs/xfs_log_recover.c > > +++ b/fs/xfs/xfs_log_recover.c > > @@ -2131,6 +2131,9 @@ xlog_recover_add_to_cont_trans( > > item =3D list_entry(trans->r_itemq.prev, struct xlog_recover_item= , > > ri_list); > > > > + if (item->ri_cnt =3D=3D 0) > > + return -EFSCORRUPTED; > > Didn't Weiming Shi already post a similar patch? Is this a duplicate, > or a complement? > > --D > Thanks for the reminder. Weiming and I both pulled one crash from the to-report dataset: The crashes are different, but they could share the same root cause. After investigation, I found it's a complement. Same root cause: a header-only item left on r_itemq with ri_cnt =3D=3D 0 and ri_buf =3D=3D NUL= L. Proved by crashing the kernel with: https://lore.kernel.org/linux-xfs/178342425117.389943.13021791343607135682.= b4-ty@b4/ Weiming's v3 3/3 guards xlog_recover_reorder_trans(), which only runs from xlog_recover_commit_trans() on an XLOG_COMMIT_TRANS op. This patch guards xlog_recover_add_to_cont_trans(), reached from the separate XLOG_WAS_CONT_TRANS case in xlog_recovery_process_trans(). Please let me know if you want us to merge them into one series. Xiang > > + > > old_ptr =3D item->ri_buf[item->ri_cnt-1].iov_base; > > old_len =3D item->ri_buf[item->ri_cnt-1].iov_len; > > > > -- > > 2.43.0 > > > >