Re: [PATCH v3 0/3] xfs: fix NULL deref in log recovery reorder

[Carlos Maiolino <cem@kernel.org>]

On Thu, 02 Jul 2026 09:19:57 -0700, Weiming Shi wrote:
> A crafted on-disk log can commit a transaction whose only item is a bare
> transaction header (ri_cnt == 0, ri_buf == NULL).
> xlog_recover_reorder_trans() then runs ITEM_TYPE() on it and dereferences
> the NULL ri_buf, faulting the kernel at mount time.
> 
> v3:
>  - patches 1 and 2: picked up the Reviewed-by tags, plus the
>    s/encountered/encounter/ fix in patch 2 that Darrick noted
>  - patch 3: reworked the changelog per Darrick and Christoph. The empty
>    item comes from the len == sizeof(xfs_trans_header) path; the check can
>    only run at commit time because a split header may still get regions
>    from later ops; and the runtime commit path never emits this, so it is
>    only reachable on a crafted log.  It came from an AI-assisted code
>    audit of the parser.  Added Cc: stable # v4.3.
> 
> [...]

Applied to for-next, thanks!

[1/3] xfs: drop ASSERT(0) on unrecognized log item type
      commit: 5b4396e12cb10fa89ca0a272fae2b5408cfeaa91
[2/3] xfs: splice unsorted log items back to the transaction after the loop
      commit: 34dd2253414d228fc9bf8a70b5f9f83107eda3e1

Best regards,
-- 
Carlos Maiolino <cem@kernel.org>