Today, xfs_recover_inode_owner_change() indicates that if XFS_ILOG_DOWNER
is set, XFS_ILOG_DBROOT must be as well, via an assert. However, this
could fail to be true due to fuzzing or corruption, so we really
should handle it gracefully rather than calling ASSERT() and crashing,
or blowing past it on a non-debug build and BUGging later.
Return -EFSCORRUPTED and fail the log replay if we find this
inconsistent state.
Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1fc9e9042e0e..56148a3083b8 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2964,7 +2964,10 @@ xfs_recover_inode_owner_change(
}
if (in_f->ilf_fields & XFS_ILOG_DOWNER) {
- ASSERT(in_f->ilf_fields & XFS_ILOG_DBROOT);
+ if (!(in_f->ilf_fields & XFS_ILOG_DBROOT)) {
+ error = -EFSCORRUPTED;
+ goto out_free_ip;
+ }
error = xfs_bmbt_change_owner(NULL, ip, XFS_DATA_FORK,
ip->i_ino, buffer_list);
if (error)
@@ -2972,7 +2975,10 @@ xfs_recover_inode_owner_change(
}
if (in_f->ilf_fields & XFS_ILOG_AOWNER) {
- ASSERT(in_f->ilf_fields & XFS_ILOG_ABROOT);
+ if (!(in_f->ilf_fields & XFS_ILOG_ABROOT)) {
+ error = -EFSCORRUPTED;
+ goto out_free_ip;
+ }
error = xfs_bmbt_change_owner(NULL, ip, XFS_ATTR_FORK,
ip->i_ino, buffer_list);
if (error)
