[PATCH 15/48] xfs: handle zero length continuation op headers during recovery

[Dave Chinner <dgc@kernel.org>]

Recovery has always had to cope with zero length op headers, but only ever
handled them as a special case in the bespoke transaction header decode.
Routing the transaction header through the generic item assembly dropped that
handling, so handle zero length continuation op headers generically for all
items instead.

A zero length op header that opens a new item carries nothing to decode, so
the item cannot be initialised until the continuation that follows arrives.
Leave a sentinel in r_cur_item for this case so the continuation is decoded as
the first region of the new item. Zero length op headers on subsequent regions
are handled naturally by the region iterator. A continuation that reaches the
append path with no item under assembly is now treated as a corrupt log.

Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
 fs/xfs/libxfs/xfs_log_recover.h |  9 +++++++
 fs/xfs/xfs_log_recover.c        | 48 +++++++++++++++++++++++++++------
 2 files changed, 49 insertions(+), 8 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_log_recover.h b/fs/xfs/libxfs/xfs_log_recover.h
index f4dbed616ee6..d2e128fca058 100644
--- a/fs/xfs/libxfs/xfs_log_recover.h
+++ b/fs/xfs/libxfs/xfs_log_recover.h
@@ -171,6 +171,15 @@ struct xlog_recover {
 	struct xlog_recover_item *r_cur_item;	/* item currently being rebuilt */
 };
 
+/*
+ * The current recovery item can sometimes start with a zero length continuation
+ * op header. In this case there is nothing to decode, so the recovery item
+ * cannot be initialised yet. Leave this sentinel in r_cur_item instead so the
+ * continuation initialises the recovery item from the start of the continued
+ * region data.
+ */
+#define XLOG_RECOVER_CONT_ITEM	((struct xlog_recover_item *)1UL)
+
 #define ITEM_TYPE(i)	(*(unsigned short *)(i)->ri_buf[0].iov_base)
 
 #define	XLOG_RECOVER_CRCPASS	0
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 37b5dbc3b239..90f841bf0aa5 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2393,6 +2393,18 @@ xlog_recover_add_to_cont_trans(
 	char			*ptr, *old_ptr;
 	int			old_len;
 
+	/*
+	 * A continuation must append to a region under assembly. The only valid
+	 * way to reach here without one is a region opened by a zero length op
+	 * header, which the dispatch in xlog_recovery_process_trans() routes to
+	 * xlog_recover_add_to_trans() instead. So no current item here means the
+	 * log is corrupt.
+	 */
+	if (!item) {
+		xfs_warn(log->l_mp, "%s: continuation with no item", __func__);
+		return -EFSCORRUPTED;
+	}
+
 	old_ptr = item->ri_buf[item->ri_cnt-1].iov_base;
 	old_len = item->ri_buf[item->ri_cnt-1].iov_len;
 
@@ -2438,8 +2450,17 @@ xlog_recover_add_to_trans(
 	char			*ptr;
 	int			error;
 
-	if (!len)
+	/*
+	 * A zero length region that opens a new item has nothing we can decode.
+	 * Leave a sentinel in r_cur_item so that xlog_recover_process_trans()
+	 * will call here again with the continuation that carries the data we
+	 * need to initialise the recovery item.
+	 */
+	if (!len) {
+		if (!trans->r_cur_item)
+			trans->r_cur_item = XLOG_RECOVER_CONT_ITEM;
 		return 0;
+	}
 
 	ptr = xlog_kvmalloc(len);
 	memcpy(ptr, dp, len);
@@ -2454,7 +2475,7 @@ xlog_recover_add_to_trans(
 	 * fragment here.
 	 */
 	item = trans->r_cur_item;
-	if (!item) {
+	if (!item || item == XLOG_RECOVER_CONT_ITEM) {
 		struct xfs_inode_log_format *in_f = /* any will do */
 			(struct xfs_inode_log_format *)ptr;
 
@@ -2510,9 +2531,10 @@ xlog_recover_free_trans(
 
 	/*
 	 * An item still being rebuilt has not been added to the item queue yet,
-	 * so free it separately.
+	 * so free it separately. The sentinel is not a real item and has nothing
+	 * to free.
 	 */
-	if (trans->r_cur_item)
+	if (trans->r_cur_item && trans->r_cur_item != XLOG_RECOVER_CONT_ITEM)
 		xlog_recover_free_item(trans->r_cur_item);
 
 	/* Free the transaction recover structure */
@@ -2557,15 +2579,25 @@ xlog_recovery_process_trans(
 	 */
 	switch (flags) {
 	/* expected flag values */
+	case XLOG_WAS_CONT_TRANS:
+		/*
+		 * A continuation appends to the region under assembly, unless
+		 * the region was opened by a zero length op header. In that case
+		 * r_cur_item holds the sentinel and this continuation carries
+		 * the first data of the region, so fall through and decode it as
+		 * the first region of a new item.
+		 */
+		if (trans->r_cur_item != XLOG_RECOVER_CONT_ITEM) {
+			error = xlog_recover_add_to_cont_trans(log, trans, dp,
+							len, region_complete);
+			break;
+		}
+		fallthrough;
 	case 0:
 	case XLOG_CONTINUE_TRANS:
 		error = xlog_recover_add_to_trans(log, trans, dp, len,
 						  region_complete);
 		break;
-	case XLOG_WAS_CONT_TRANS:
-		error = xlog_recover_add_to_cont_trans(log, trans, dp, len,
-						       region_complete);
-		break;
 	case XLOG_COMMIT_TRANS:
 		error = xlog_recover_commit_trans(log, trans, pass,
 						  buffer_list);
-- 
2.55.0