From nobody Sat Jul 25 22:33:06 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E749F37205D for ; Sun, 12 Jul 2026 22:08:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783894139; cv=none; b=BeFZjHcFQavV20ijTn67dMzY0kUseyp9Vj0nepLhuRROc3IVgS+QEVvkkcT8XYpq+wgIzyNNSEw1wkvViJz5ZR3TUW0dEqQe/xhUK3CEHARIzpVB2CGpqypjKh7yUl46leIMhPDxs4aYHGA3v5iNmYlfW2KJb+sND1YsTO6KOTs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783894139; c=relaxed/simple; bh=4BuUyPARn/tz3lsDji72T9JUUe3DM1Pt0tBK6CMeVoY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YrbvmsRhZ64LmxEQatAQ/NlqcqU/F2aDqmUSz8mC7VConHcYcEcEQr7ty5u54bXAMXBUcro6480noxwDYWMobnaR9ql4vptmW7i/MKIj+ZSbmANOiUH77MSrzoucR+N4Mw+xtUy8Vuv0qjTyTXgPDWeOrYPifb2Ez5Nbkzgg67U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=lvfcki/m; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="lvfcki/m" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2caea3f742bso27770005ad.0 for ; Sun, 12 Jul 2026 15:08:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783894137; x=1784498937; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=DL9w1+Cjadf8xCjP1+t/5nY7oqPs2u0aMgQpWvEYT3U=; b=lvfcki/meoukVb5r0i8x3095dmV/CLivCb3YzBDo4vD+JM0AUXGZyoQRKlS/+xOlNJ UkAjZ1m6wtQ0dXt+H9l7IO3QdHdP4c3Itm8mNmVHxOd03iw0a8yw2Ojs0JdvQBcWFPF2 21UYPRQHEA3C/htowzYw7SX2yiURiT7r4MhXOTbRt9dMa6UHY9Rb635sc+sMGjNkim8m LuWm3w1/pUyV0fbLKb3Ab2AffihCdBVDqyevlszqC0NkZT5QTNt6ptZzG8bkX75JVUna 0hnWdk/uOJTB1NwHc6U2yj7JHyHXkzIJryuVukrK/bMyVpDSK7VZxpE3Wpz4X9Sk7USV oM5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783894137; x=1784498937; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DL9w1+Cjadf8xCjP1+t/5nY7oqPs2u0aMgQpWvEYT3U=; b=PO0BheYVqX+uLALXbIsDBO4AdGU+nebZ5ypxmIe48+7bi54HJwOIhNwXO/u36vCVdQ RR/RwpfHbWfel5Ezq/7eoZbE6Apmlua5Dx+e8UZjCNggSs3nKSgBjpowYbt1D5tpOxKx TkhHULT/0XSVANgMLTImSahSRUt+Yuqm/6dkdOPYP1yUL1GH+ZLcAkv4kZZmcVMyYPin OnJ1ZCdtq2sbmA2dBLIkGsELok5sfmZKVWPFEM6Ac6V9HY3Crz1dXuDgXFG0TRImSN7D rxGsR9AbryzAhblDFNaPCeESgDDG8Km/neGQm5/n2AZSQW9KRuKVeZmigsTCxWDvDONy yBAQ== X-Forwarded-Encrypted: i=1; AHgh+Roa2mGYc+dZbkO3QRfkHI5STP4tgDfoxHFq7u9DerbMBHqVCH1v2kzndCUc+KsSKHDk18lMOVwhmUdOMkY=@vger.kernel.org X-Gm-Message-State: AOJu0YwHnx4szJiYpm+Q7yfZtXynEJSPeSQunAddfZQqWzjtSBV/yDpg S7eLM4ijaLeW5XXYbSGrBUATbKQ3fk1It3oCgmDb2ApXoB/cn+BXZXFkJ9OT2y37wQ== X-Gm-Gg: AfdE7cn2YRdjnP7J34lkpP7hQeVQRgtUBjJSLQuP/FA2jLeR0fBnDy7pGL3HJT/4DrK SJk/gSc6AkV/REPWh7Zkp9k6XL9k4QJe2iCei/uW1oup5qq42RIwRBn2Funhdbnek4qSHvUOLVd kS9FzOlpnYNMwutKuf/Do3oSFZuLbJ2qqV2zsBd0ONlQdJwt6L+WUyXxD+jGrCnoTOWXvM3kHN0 Rvi3HQBjxglWTXlXvgoapj/YDPmhKELD/XMnAW+qRMeXobfCx97QdRo0xvr/6yWYhEmU0sfb5cm zbAHn4qWFQodzqGb1aUT8hrETFauy9I6Nm0uDskzoUP3Zjp5/1cpjZ1q/ux5/k+4FgHAOcSuKTx 7XtHVGTTohq1W2ZB4zGKzX9mGm8mWjaduC/5pd0NbFNDsX1ajKxhFsjNyfxTumHi/NLl5atjyM1 lRDh7x8a0= X-Received: by 2002:a17:902:f683:b0:2ca:481:de45 with SMTP id d9443c01a7336-2ce9e7ac3d4mr66677185ad.6.1783894137334; Sun, 12 Jul 2026 15:08:57 -0700 (PDT) Received: from p1.. ([2607:fb90:eca4:601:96a2:dc03:fbca:601e]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bdb775sm89285145ad.2.2026.07.12.15.08.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 15:08:57 -0700 (PDT) From: Xiang Mei To: Carlos Maiolino Cc: linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org, bestswngs@gmail.com, Xiang Mei Subject: [PATCH] xfs: reject log continuation for a header-only item in recovery Date: Sun, 12 Jul 2026 15:08:54 -0700 Message-ID: <20260712220854.3131445-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On an XLOG_WAS_CONT_TRANS op, xlog_recover_add_to_cont_trans() extends the tail item's last region via item->ri_buf[item->ri_cnt-1] without checking that the item has one. A header-only item, created by xlog_recover_add_to_trans() when a transaction's first op is a bare sizeof(struct xfs_trans_header) op carrying XFS_TRANS_HEADER_MAGIC, sits on r_itemq with ri_cnt =3D=3D 0 and ri_buf =3D=3D NULL. A crafted log whose op= s are XLOG_START_TRANS, that header op, then XLOG_WAS_CONT_TRANS thus dereferences ((struct kvec *)NULL)[-1] and faults during mount(2) log recovery of an untrusted XFS image. A valid XLOG_WAS_CONT_TRANS only follows a region written with XLOG_CONTINUE_TRANS, so ri_cnt >=3D 1 always holds for a real log. Reject t= he ri_cnt =3D=3D 0 case as corruption with -EFSCORRUPTED, which the caller alr= eady propagates to abort recovery. BUG: unable to handle page fault for address: fffffffffffffff0 #PF: supervisor read access in kernel mode Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:xlog_recover_add_to_cont_trans (fs/xfs/xfs_log_recover.c:2135) Call Trace: xlog_recovery_process_trans (fs/xfs/xfs_log_recover.c:2306) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2500) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3243) xlog_do_log_recovery (fs/xfs/xfs_log_recover.c:3331) xlog_do_recover (fs/xfs/xfs_log_recover.c:3368) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:617) xfs_mountfs (fs/xfs/xfs_mount.c:1031) xfs_fs_fill_super (fs/xfs/xfs_super.c:1940) get_tree_bdev_flags (fs/super.c:1634) vfs_get_tree (fs/super.c:1694) fc_mount (fs/namespace.c:1198) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei Reviewed-by: Christoph Hellwig --- fs/xfs/xfs_log_recover.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index 5f984bf5698a..fa8e04bf1aac 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2131,6 +2131,9 @@ xlog_recover_add_to_cont_trans( item =3D list_entry(trans->r_itemq.prev, struct xlog_recover_item, ri_list); =20 + if (item->ri_cnt =3D=3D 0) + return -EFSCORRUPTED; + old_ptr =3D item->ri_buf[item->ri_cnt-1].iov_base; old_len =3D item->ri_buf[item->ri_cnt-1].iov_len; =20 --=20 2.43.0