[PATCH 16/48] xfs: bound the assembled region size during recovery

[Dave Chinner <dgc@kernel.org>]

A region split across continuation op headers is grown one fragment at a time
with no limit on the total size, so a corrupt continuation stream can drive an
unbounded allocation during recovery.

Add XLOG_MAX_REGION_SIZE - the largest object logged in a single region - as a
format level bound usable by both the log write and recovery paths, and reject
a continuation once the assembled region would exceed it. Use the same constant
for the existing per-op-header length check.

Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
 fs/xfs/libxfs/xfs_log_format.h |  8 ++++++++
 fs/xfs/xfs_log_recover.c       | 21 ++++++++++++---------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h
index 6e620380d5dc..6d49cb831d73 100644
--- a/fs/xfs/libxfs/xfs_log_format.h
+++ b/fs/xfs/libxfs/xfs_log_format.h
@@ -38,6 +38,14 @@ typedef uint32_t xlog_tid_t;
 
 #define XLOG_HEADER_SIZE	512
 
+/*
+ * The largest object that is logged in a single region: a whole buffer in a
+ * buffer log item, or a remote attribute value. This bounds the size of any
+ * single log region both when writing the log and when reassembling regions
+ * during recovery.
+ */
+#define XLOG_MAX_REGION_SIZE	max(XFS_MAX_BLOCKSIZE, XFS_XATTR_SIZE_MAX)
+
 /* Minimum number of transactions that must fit in the log (defined by mkfs) */
 #define XFS_MIN_LOG_FACTOR	3
 
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 90f841bf0aa5..c35bb0fb3249 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2408,6 +2408,16 @@ xlog_recover_add_to_cont_trans(
 	old_ptr = item->ri_buf[item->ri_cnt-1].iov_base;
 	old_len = item->ri_buf[item->ri_cnt-1].iov_len;
 
+	/*
+	 * Bound the assembled region size before growing the buffer so a corrupt
+	 * continuation stream cannot drive an unbounded allocation.
+	 */
+	if (old_len + len > XLOG_MAX_REGION_SIZE) {
+		xfs_warn(log->l_mp, "%s: region too large (0x%x)",
+			__func__, old_len + len);
+		return -EFSCORRUPTED;
+	}
+
 	ptr = kvrealloc(old_ptr, len + old_len, GFP_KERNEL);
 	if (!ptr)
 		return -ENOMEM;
@@ -2781,15 +2791,8 @@ xlog_recover_validate_ophdr(
 		return ERR_PTR(-EFSCORRUPTED);
 	}
 
-	/*
-	 * A single region cannot be larger than the largest object we log in
-	 * one region. That is a whole buffer in a buffer log item (up to
-	 * XFS_MAX_BLOCKSIZE, e.g. a 64k directory block on a 4k block size
-	 * filesystem) or a remote attribute value (up to XFS_XATTR_SIZE_MAX,
-	 * logged in its own region); both are 64k.
-	 */
-	BUILD_BUG_ON(XFS_XATTR_SIZE_MAX > XFS_MAX_BLOCKSIZE);
-	if (len > XFS_MAX_BLOCKSIZE) {
+	/* A single region cannot be larger than the largest object we log. */
+	if (len > XLOG_MAX_REGION_SIZE) {
 		xfs_warn(log->l_mp, "%s: length 0x%x too large", __func__, len);
 		return ERR_PTR(-EFSCORRUPTED);
 	}
-- 
2.55.0