From: Dave Chinner <dgc@kernel.org>
To: linux-xfs@vger.kernel.org
Cc: cem@kernel.org
Subject: [PATCH 32/48] xfs: validate attr intents during recovery
Date: Tue, 13 Oct 2026 17:01:22 +1100 [thread overview]
Message-ID: <20261013060204.3138690-33-dgc@kernel.org> (raw)
In-Reply-To: <20261013060204.3138690-1-dgc@kernel.org>
An attr intent is a format header region followed by up to four name and value
regions, the number and contents of which depend on the operation it describes.
Recovery validated all of this inline in the commit handler, interleaved with
building the in-core item, so the item was validated only as it was being set
up for replay.
Validate the attr intent as it is decoded instead. Region lengths are bounded
as the regions are assembled. Exact region length validation is done during
item validation. The commit handler is then left to do only the replay setup:
pull the validated name and value regions out of the item and build the in-core
intent from them.
Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
fs/xfs/xfs_attr_item.c | 249 +++++++++++++++++++++++++----------------
1 file changed, 151 insertions(+), 98 deletions(-)
diff --git a/fs/xfs/xfs_attr_item.c b/fs/xfs/xfs_attr_item.c
index a6e36b2aa7b3..cd0225957c6d 100644
--- a/fs/xfs/xfs_attr_item.c
+++ b/fs/xfs/xfs_attr_item.c
@@ -1002,151 +1002,200 @@ xlog_recover_attri_commit_pass2(
{
struct xfs_mount *mp = log->l_mp;
struct xfs_attri_log_item *attrip;
- struct xfs_attri_log_format *attri_formatp;
+ struct xfs_attri_log_format *attri_formatp = item->ri_buf[0].iov_base;
struct xfs_attri_log_nameval *nv;
const void *attr_name;
const void *attr_value = NULL;
const void *attr_new_name = NULL;
const void *attr_new_value = NULL;
- size_t len;
unsigned int name_len = 0;
unsigned int value_len = 0;
unsigned int new_name_len = 0;
unsigned int new_value_len = 0;
- unsigned int op, i = 0;
+ unsigned int i = 1;
- /* Validate xfs_attri_log_format before the large memory allocation */
- len = sizeof(struct xfs_attri_log_format);
- if (item->ri_buf[i].iov_len != len) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- item->ri_buf[0].iov_base, item->ri_buf[0].iov_len);
- return -EFSCORRUPTED;
+ /*
+ * The item has already been validated, so pull the name and value
+ * lengths out of the format header. The regions present depend on the
+ * operation being performed.
+ */
+ switch (xfs_attr_log_item_op(attri_formatp)) {
+ case XFS_ATTRI_OP_FLAGS_PPTR_REMOVE:
+ case XFS_ATTRI_OP_FLAGS_PPTR_SET:
+ case XFS_ATTRI_OP_FLAGS_SET:
+ case XFS_ATTRI_OP_FLAGS_REPLACE:
+ name_len = attri_formatp->alfi_name_len;
+ value_len = attri_formatp->alfi_value_len;
+ break;
+ case XFS_ATTRI_OP_FLAGS_REMOVE:
+ name_len = attri_formatp->alfi_name_len;
+ break;
+ case XFS_ATTRI_OP_FLAGS_PPTR_REPLACE:
+ name_len = attri_formatp->alfi_old_name_len;
+ new_name_len = attri_formatp->alfi_new_name_len;
+ new_value_len = value_len = attri_formatp->alfi_value_len;
+ break;
}
- attri_formatp = item->ri_buf[i].iov_base;
- if (!xfs_attri_validate(mp, attri_formatp)) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ /* Pull the name and value regions out in the order they are logged. */
+ attr_name = item->ri_buf[i++].iov_base;
+ if (new_name_len > 0)
+ attr_new_name = item->ri_buf[i++].iov_base;
+ if (value_len > 0)
+ attr_value = item->ri_buf[i++].iov_base;
+ if (new_value_len > 0)
+ attr_new_value = item->ri_buf[i++].iov_base;
+
+ /*
+ * Memory alloc failure will cause replay to abort. We attach the
+ * name/value buffer to the recovered incore log item and drop our
+ * reference.
+ */
+ nv = xfs_attri_log_nameval_alloc(attr_name, name_len,
+ attr_new_name, new_name_len,
+ attr_value, value_len,
+ attr_new_value, new_value_len);
+
+ attrip = xfs_attri_init(mp, nv);
+ memcpy(&attrip->attri_format, attri_formatp,
+ sizeof(struct xfs_attri_log_format));
+
+ xlog_recover_intent_item(log, &attrip->attri_item, lsn,
+ &xfs_attr_defer_type);
+ xfs_attri_log_nameval_put(nv);
+ return 0;
+}
+
+/*
+ * An attri has a format header region followed by up to four name and value
+ * regions, the exact number depending on the operation it describes. The exact
+ * count for the operation is checked once the format header is decoded in
+ * ->validate_item(); here we only bound the count to the possible range.
+ */
+static int
+xlog_recover_attri_nregions(
+ struct xlog *log,
+ uint16_t nregions)
+{
+ if (nregions < 2 || nregions > 5)
return -EFSCORRUPTED;
+ return nregions;
+}
+
+/*
+ * Bound each region by its largest possible size. Region 0 is the fixed size
+ * format header. Region 1 is always a name, so no larger than a maximum length
+ * attr name. Regions 2 to 4 may be a name or a value, so no larger than a
+ * maximum length attr value. This detects an unbounded continuation of a region
+ * before the exact per-operation sizes are checked in ->validate_item().
+ */
+static int
+xlog_recover_attri_validate_region(
+ struct xlog *log,
+ struct xlog_recover_item *item,
+ int region_index)
+{
+ size_t len = item->ri_buf[region_index].iov_len;
+
+ if (region_index == 0) {
+ if (len != sizeof(struct xfs_attri_log_format))
+ goto out_error;
+ return 0;
}
- /* Check the number of log iovecs makes sense for the op code. */
- op = xfs_attr_log_item_op(attri_formatp);
- switch (op) {
+ if (region_index == 1) {
+ if (len > xlog_calc_iovec_len(XATTR_NAME_MAX))
+ goto out_error;
+ return 0;
+ }
+
+ if (len > xlog_calc_iovec_len(XATTR_SIZE_MAX))
+ goto out_error;
+ return 0;
+
+out_error:
+ xfs_warn(log->l_mp, "ATTRI: bad region %d length %zu recovered.",
+ region_index, len);
+ return -EFSCORRUPTED;
+}
+
+/*
+ * Validate the whole attri: the format header, the exact region count for the
+ * operation it describes, and the name and value regions that operation
+ * requires. Once this passes, the rest of recovery can walk the regions without
+ * checking them.
+ */
+static int
+xlog_recover_attri_validate_item(
+ struct xlog *log,
+ struct xlog_recover_item *item)
+{
+ struct xfs_mount *mp = log->l_mp;
+ struct xfs_attri_log_format *attri_formatp = item->ri_buf[0].iov_base;
+ unsigned int name_len = 0;
+ unsigned int value_len = 0;
+ unsigned int new_name_len = 0;
+ unsigned int new_value_len = 0;
+ unsigned int i = 1;
+
+ if (!xfs_attri_validate(mp, attri_formatp))
+ return -EFSCORRUPTED;
+
+ /* Check the number of regions makes sense for the op code. */
+ switch (xfs_attr_log_item_op(attri_formatp)) {
case XFS_ATTRI_OP_FLAGS_PPTR_REMOVE:
case XFS_ATTRI_OP_FLAGS_PPTR_SET:
- /* Log item, attr name, attr value */
- if (item->ri_total != 3) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ /* Format header, attr name, attr value */
+ if (item->ri_total != 3)
return -EFSCORRUPTED;
- }
name_len = attri_formatp->alfi_name_len;
value_len = attri_formatp->alfi_value_len;
break;
case XFS_ATTRI_OP_FLAGS_SET:
case XFS_ATTRI_OP_FLAGS_REPLACE:
- /* Log item, attr name, optional attr value */
- if (item->ri_total != 2 + !!attri_formatp->alfi_value_len) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ /* Format header, attr name, optional attr value */
+ if (item->ri_total != (2 + !!attri_formatp->alfi_value_len))
return -EFSCORRUPTED;
- }
name_len = attri_formatp->alfi_name_len;
value_len = attri_formatp->alfi_value_len;
break;
case XFS_ATTRI_OP_FLAGS_REMOVE:
- /* Log item, attr name */
- if (item->ri_total != 2) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ /* Format header, attr name */
+ if (item->ri_total != 2)
return -EFSCORRUPTED;
- }
name_len = attri_formatp->alfi_name_len;
break;
case XFS_ATTRI_OP_FLAGS_PPTR_REPLACE:
- /*
- * Log item, attr name, new attr name, attr value, new attr
- * value
- */
- if (item->ri_total != 5) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ /* Format header, attr name, new name, attr value, new value */
+ if (item->ri_total != 5)
return -EFSCORRUPTED;
- }
name_len = attri_formatp->alfi_old_name_len;
new_name_len = attri_formatp->alfi_new_name_len;
new_value_len = value_len = attri_formatp->alfi_value_len;
break;
default:
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
return -EFSCORRUPTED;
}
- i++;
- /* Validate the attr name */
- attr_name = xfs_attri_validate_name_iovec(mp, attri_formatp,
- &item->ri_buf[i], name_len);
- if (!attr_name)
+ if (!xfs_attri_validate_name_iovec(mp, attri_formatp, &item->ri_buf[i++],
+ name_len))
return -EFSCORRUPTED;
- i++;
-
- /* Validate the new attr name */
- if (new_name_len > 0) {
- attr_new_name = xfs_attri_validate_name_iovec(mp,
- attri_formatp, &item->ri_buf[i],
- new_name_len);
- if (!attr_new_name)
- return -EFSCORRUPTED;
- i++;
- }
-
- /* Validate the attr value, if present */
- if (value_len != 0) {
- attr_value = xfs_attri_validate_value_iovec(mp, attri_formatp,
- &item->ri_buf[i], value_len);
- if (!attr_value)
- return -EFSCORRUPTED;
- i++;
- }
-
- /* Validate the new attr value, if present */
- if (new_value_len != 0) {
- attr_new_value = xfs_attri_validate_value_iovec(mp,
- attri_formatp, &item->ri_buf[i],
- new_value_len);
- if (!attr_new_value)
- return -EFSCORRUPTED;
- i++;
- }
- /*
- * Make sure we got the correct number of buffers for the operation
- * that we just loaded.
- */
- if (i != item->ri_total) {
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- attri_formatp, len);
+ if (new_name_len > 0 &&
+ !xfs_attri_validate_name_iovec(mp, attri_formatp, &item->ri_buf[i++],
+ new_name_len))
return -EFSCORRUPTED;
- }
- /*
- * Memory alloc failure will cause replay to abort. We attach the
- * name/value buffer to the recovered incore log item and drop our
- * reference.
- */
- nv = xfs_attri_log_nameval_alloc(attr_name, name_len,
- attr_new_name, new_name_len,
- attr_value, value_len,
- attr_new_value, new_value_len);
+ if (value_len > 0 &&
+ !xfs_attri_validate_value_iovec(mp, attri_formatp, &item->ri_buf[i++],
+ value_len))
+ return -EFSCORRUPTED;
- attrip = xfs_attri_init(mp, nv);
- memcpy(&attrip->attri_format, attri_formatp, len);
+ if (new_value_len > 0 &&
+ !xfs_attri_validate_value_iovec(mp, attri_formatp, &item->ri_buf[i++],
+ new_value_len))
+ return -EFSCORRUPTED;
- xlog_recover_intent_item(log, &attrip->attri_item, lsn,
- &xfs_attr_defer_type);
- xfs_attri_log_nameval_put(nv);
return 0;
}
@@ -1210,6 +1259,10 @@ static const struct xfs_item_ops xfs_attri_item_ops = {
const struct xlog_recover_item_ops xlog_attri_item_ops = {
.item_type = XFS_LI_ATTRI,
+ .min_hdr_len = sizeof(struct xfs_attri_log_format),
+ .validate_nregions = xlog_recover_attri_nregions,
+ .validate_region = xlog_recover_attri_validate_region,
+ .validate_item = xlog_recover_attri_validate_item,
.commit_pass2 = xlog_recover_attri_commit_pass2,
};
--
2.55.0
next prev parent reply other threads:[~2026-10-13 6:02 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 6:00 [RFC] [PATCH 00/48] Validate journal log items during log recovery Dave Chinner
2026-10-13 6:00 ` [PATCH 01/48] xfs: set the unmount record operation header length Dave Chinner
2026-10-13 6:00 ` [PATCH 02/48] xfs: add log recovery item validation design document Dave Chinner
2026-10-13 6:00 ` [PATCH 03/48] xfs: lift transaction header parsing out of the region assembly Dave Chinner
2026-10-13 6:00 ` [PATCH 04/48] xfs: track transaction header decode state explicitly Dave Chinner
2026-10-13 6:00 ` [PATCH 05/48] xfs: track the log item being rebuilt with an explicit pointer Dave Chinner
2026-10-13 6:00 ` [PATCH 06/48] xfs: complete log items explicitly during recovery Dave Chinner
2026-10-13 6:00 ` [PATCH 07/48] xfs: add log item validation infrastructure to log recovery Dave Chinner
2026-10-13 6:00 ` [PATCH 08/48] xfs: recover the transaction header as a validated item type Dave Chinner
2026-10-13 6:00 ` [PATCH 09/48] xfs: factor out xlog_recover_validate_ophdr() Dave Chinner
2026-10-13 6:01 ` [PATCH 10/48] xfs: validate operation header length and alignment during recovery Dave Chinner
2026-10-13 6:01 ` [PATCH 11/48] xfs: validate the operation header padding " Dave Chinner
2026-10-13 6:01 ` [PATCH 12/48] xfs: validate the operation header flags " Dave Chinner
2026-10-13 6:01 ` [PATCH 13/48] xfs: enforce zero length control records " Dave Chinner
2026-10-13 6:01 ` [PATCH 14/48] xfs: validate the unmount record " Dave Chinner
2026-10-13 6:01 ` [PATCH 15/48] xfs: handle zero length continuation op headers " Dave Chinner
2026-10-13 6:01 ` [PATCH 16/48] xfs: bound the assembled region size " Dave Chinner
2026-10-13 6:01 ` [PATCH 17/48] xfs: dump the corrupt region when log item validation fails Dave Chinner
2026-10-13 6:01 ` [PATCH 18/48] xfs: validate fixed size log items during recovery Dave Chinner
2026-10-13 6:01 ` [PATCH 19/48] xfs: validate extent free " Dave Chinner
2026-10-13 6:01 ` [PATCH 20/48] xfs: validate and convert extent free intents " Dave Chinner
2026-10-13 6:01 ` [PATCH 21/48] xfs: validate and convert extent free done items " Dave Chinner
2026-10-13 6:01 ` [PATCH 22/48] xfs: validate rmap update intents " Dave Chinner
2026-10-13 6:01 ` [PATCH 23/48] xfs: validate rmap update done items " Dave Chinner
2026-10-13 6:01 ` [PATCH 24/48] xfs: validate refcount update intents " Dave Chinner
2026-10-13 6:01 ` [PATCH 25/48] xfs: validate refcount update done items " Dave Chinner
2026-10-13 6:01 ` [PATCH 26/48] xfs: validate bmap update intents " Dave Chinner
2026-10-13 6:01 ` [PATCH 27/48] xfs: validate bmap update done items " Dave Chinner
2026-10-13 6:01 ` [PATCH 28/48] xfs: validate mapping exchange intents " Dave Chinner
2026-10-13 6:01 ` [PATCH 29/48] xfs: validate mapping exchange done items " Dave Chinner
2026-10-13 6:01 ` [PATCH 30/48] xfs: validate dquot " Dave Chinner
2026-10-13 6:01 ` [PATCH 31/48] xfs: validate attr done " Dave Chinner
2026-10-13 6:01 ` Dave Chinner [this message]
2026-10-13 6:01 ` [PATCH 33/48] xfs: convert inode items to host format " Dave Chinner
2026-10-13 6:01 ` [PATCH 34/48] xfs: allow xfs_imap() to map without an inode btree lookup Dave Chinner
2026-10-13 6:01 ` [PATCH 35/48] xfs: validate the inode item format header during recovery Dave Chinner
2026-10-13 6:01 ` [PATCH 36/48] xfs: validate the logged inode core " Dave Chinner
2026-10-13 6:01 ` [PATCH 37/48] xfs: validate the logged inode forks " Dave Chinner
2026-10-13 6:01 ` [PATCH 38/48] xfs: validate logged local fork contents " Dave Chinner
2026-10-13 6:01 ` [PATCH 39/48] xfs: validate logged extent " Dave Chinner
2026-10-13 6:01 ` [PATCH 40/48] xfs: allow a long format btree root to be checked without a cursor Dave Chinner
2026-10-13 6:01 ` [PATCH 41/48] xfs: validate logged btree fork roots during recovery Dave Chinner
2026-10-13 6:01 ` [PATCH 42/48] xfs: validate logged metadata " Dave Chinner
2026-10-13 6:01 ` [PATCH 43/48] xfs: validate buffer item region count " Dave Chinner
2026-10-13 6:01 ` [PATCH 44/48] xfs: validate buffer item regions " Dave Chinner
2026-10-13 6:01 ` [PATCH 45/48] xfs: validate the whole buffer item " Dave Chinner
2026-10-13 6:01 ` [PATCH 46/48] xfs: remove redundant buffer checks from recovery replay Dave Chinner
2026-10-13 6:01 ` [PATCH 47/48] xfs: fail recovery on a buffer type mismatch Dave Chinner
2026-10-13 6:01 ` [PATCH 48/48] xfs: validate logged dquot buffers during recovery Dave Chinner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261013060204.3138690-33-dgc@kernel.org \
--to=dgc@kernel.org \
--cc=cem@kernel.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox