[PATCH v2 0/3] xfs: fix NULL deref in log recovery reorder

[Weiming Shi <bestswngs@gmail.com>]

A crafted XFS image can commit a transaction whose only item is a bare
transaction header (ri_cnt == 0, ri_buf == NULL).
xlog_recover_reorder_trans() then runs ITEM_TYPE() on it and dereferences
the NULL ri_buf, faulting the kernel at mount time.

v1 was a single patch that added the check but kept an ASSERT(0) on the
path and duplicated the sort_list splice.  Per Christoph's review, v2
splits it:

  1: drop the existing ASSERT(0) on an unrecognized item type
  2: move the sort_list splice out of the loop (no functional change)
  3: add the check that rejects a committed item with no regions

Patch 3 also notes that, since the log is CRC-checked, this is a crafted
image rather than media corruption.

Tested on xfs-7.2-fixes with KASAN: the unpatched kernel oopses in
xlog_recover_reorder_trans; the patched kernel fails the mount with
-EFSCORRUPTED and no splat.

Weiming Shi (3):
  xfs: drop ASSERT(0) on unrecognized log item type
  xfs: splice unsorted log items back to the transaction after the loop
  xfs: fail recovery on a committed log item with no regions

 fs/xfs/xfs_log_recover.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

-- 
2.43.0