[BUG] xfs: undersized log triggers assertion in xfs_log_mount()

[铮]

Hi Carlos,

Executing the stored syzkaller testcases on Linux 7.3.0 ultimately triggers
an assertion in xfs_log_mount():

  XFS (loop0): AAIEEE! Log failed size checks. Abort!
  XFS: Assertion failed: 0, file: fs/xfs/xfs_log.c, line: 597
  kernel BUG at fs/xfs/xfs_message.c:102!
  ...
  xfs_log_mount+0x4e3/0x590
  xfs_mountfs+0x10b9/0x2270
  xfs_fs_fill_super+0x15cc/0x20b0
  ...
  Kernel panic - not syncing: Fatal exception

The log size check reports 516 blocks, below the required minimum of
636 blocks.

Is this an expected assertion with my XFS debug configuration, or should
this malformed image be rejected without triggering a kernel BUG?

I am reporting an observable assertion from a syzkaller reproduction. I am
not claiming a new vulnerability or a specific root cause.

Environment
-----------
- Kernel: 7.3.0-kernsight-kasan #1 SMP PREEMPT_DYNAMIC (2026-10-20),
  x86_64, KASAN/KCOV. Source: mainline Linux v7.3, commit
  091b06388b117fefdcb63336ac09956a4914b961, release tarball sha256
  87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953.
- XFS config: CONFIG_XFS_DEBUG=y, CONFIG_XFS_DEBUG_EXPENSIVE=y,
  CONFIG_XFS_ASSERT_FATAL=y. The full configuration is available as
  kernel/kernel-7.3.config in the repository.
- Kernel source changes: none for XFS or the VFS. The KernSight changes are
  in the syzkaller tree, not in the kernel.
- Taint: Not tainted (the report above is from a clean boot).
- Guest: QEMU 6.2.0, 4 vCPU, 6 GiB, KVM, x86_64; a fresh VM per run.
- Syzkaller: revision 853b104bb454141a5b0fc0e4218ec78e9f34ffb1+
  (2026-09-18). The "+" denotes local KernSight integration (seed ordering/
  state feedback: pkg/kernsight, prog/kernsight_*, syz-manager/kernsight_*,
  pkg/execbackend, vm/qemu snapshot support). It does not change the XFS
  syscall descriptions or the executor's fault-injection semantics.
- Full kernel command line:
  7.3/cmdline-7.3-20261024.txt in the repository.
- An additional fresh-VM validation on 2026-10-28 confirmed that
  repro.kernsight.prog alone triggers the assertion using the command
  below. The kernel BUG occurred at approximately 162.26 seconds after
  boot.

Reproduction
------------
The trigger is the state-construction recipe alone
(`repro.kernsight.prog`, ~2.6 MB); the smaller `repro.prog` (~24 KB) is not
needed. There is no standalone XFS image file; the image data is embedded in
the recipe. Run it on a fresh VM:

  scp syz-execprog syz-executor repro/repro.kernsight.prog root@guest:/tmp/
  ssh root@guest
  cd /tmp && chmod +x syz-execprog syz-executor
  ./syz-execprog -procs=1 -repeat=1 -disable=swap -executor
./syz-executor ./repro.kernsight.prog

Earlier observation on 7.3.0 (2026-10-24)
----------------------------------------
```
[ 155.506948][T11067] XFS (loop0): AAIEEE! Log failed size checks. Abort!
[ 155.506958][T11067] XFS: Assertion failed: 0, file:
fs/xfs/xfs_log.c, line: 597
[ 155.507283][T11067] ------------[ cut here ]------------
[ 155.507292][T11067] kernel BUG at fs/xfs/xfs_message.c:102!
[ 155.507311][T11067] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
[ 155.513319][T11067] CPU: 2 UID: 0 PID: 11067 Comm: syz.0.50 Not
tainted 7.3.0-kernsight-kasan #1 PREEMPT(full)
[ 155.515662][T11067] RIP: 0010:assfail+0xa2/0xb0
[ 155.527881][T11067] Call Trace:
[ 155.528122][T11067]  xfs_log_mount+0x4e3/0x590
[ 155.528503][T11067]  xfs_mountfs+0x10b9/0x2270
[ 155.530595][T11067]  xfs_fs_fill_super+0x15cc/0x20b0
[ 155.531014][T11067]  get_tree_bdev_flags+0x38e/0x620
[ 155.553843][T11067] Kernel panic - not syncing: Fatal exception
```

Questions
---------
- Is triggering a fatal assertion for an undersized V5 log intentional
  with CONFIG_XFS_DEBUG=y and CONFIG_XFS_ASSERT_FATAL=y, or should this
  case return -EINVAL without triggering a BUG?
- If a diagnostic dump would help, what state should be printed before the
  assertion so the malformed image/log geometry can be identified?

Materials
---------
The full testcases, 7.3.0 serial/console logs, crash report, .config and
reproduction script are in the public repository:

  https://github.com/Zheng-zheng-codes/e713403e-xfs-assfail-repro

Contents include:
  repro/repro.kernsight.prog             state-construction recipe (~2.6 MB)
  repro/repro.prog                       small testcase (~24 KB; NOT needed)
  7.3/validation-run-20261028/          2026-10-28 recipe-only validation
                                         (serial log, boot information,
                                         kernel command line)
  7.3/serial-7.3-20261024.log            full boot-to-crash serial log
  7.3/crash-excerpt-7.3-20261024.txt     extracted crash report
  7.3/console-7.3-20261024.log
  7.3/cmdline-7.3-20261024.txt
  7.3/boot-info-7.3-20261024.txt
  7.3/RESULT.txt                          earlier 2026-10-24 harness result
                                         (its 466 s is the old harness duration,
                                         not the 162.26 s crash time above)
  kernel/kernel-7.3.config, kernel/SOURCES.md
  reproduce.sh, verify.sh, MANIFEST.sha256

Best regards,
Zheng Zheng