[PATCH 13/48] xfs: enforce zero length control records during recovery

[Dave Chinner <dgc@kernel.org>]

Start and commit records only bracket a transaction and carry no data of
their own, but recovery only asserted this for start records and did not check
it for commit records, so a corrupt non-zero length on either was accepted on
production builds.

Enforce the zero length for both in the operation header flag validation and
drop the now redundant assert.

Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
 fs/xfs/xfs_log_recover.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index fd53b365a8a0..0ba3f4409d28 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2618,8 +2618,6 @@ xlog_recover_ophdr_to_trans(
 	if (!(ohead->oh_flags & XLOG_START_TRANS))
 		return NULL;
 
-	ASSERT(be32_to_cpu(ohead->oh_len) == 0);
-
 	/*
 	 * This is a new transaction so allocate a new recovery container to
 	 * hold the recovery ops that will follow.
@@ -2726,9 +2724,19 @@ xlog_recover_validate_ophdr(
 	 * stand alone.
 	 */
 	switch (ohead->oh_flags) {
-	case 0:
 	case XLOG_START_TRANS:
 	case XLOG_COMMIT_TRANS:
+		/*
+		 * Start and commit records only bracket a transaction and carry
+		 * no data of their own.
+		 */
+		if (len != 0) {
+			xfs_warn(log->l_mp, "%s: bad control record length 0x%x",
+				__func__, len);
+			return ERR_PTR(-EFSCORRUPTED);
+		}
+		break;
+	case 0:
 	case XLOG_CONTINUE_TRANS:
 	case XLOG_WAS_CONT_TRANS | XLOG_CONTINUE_TRANS:
 	case XLOG_WAS_CONT_TRANS | XLOG_END_TRANS:
-- 
2.55.0