xfs log recovery: six distinct issues, one per report (index)

[Guikun Yang]

Hi,

Between 2026-11-07 and 2026-11-09 I sent six separate reports about
log recovery in fs/xfs. They were posted as replies under one subject
line, which was a mistake on my part - they are independent defects,
each with its own root cause, its own reproducer and its own fix. This
mail is an index so they can be handled one by one; no action beyond
that is implied.

1. XLOG_WAS_CONT_TRANS with no buffered region reads ri_buf[-1]
   native NULL deref at mount, no sanitizer needed
   Message-ID: <c30-xfs-wascont-rideref-20261107@xxxxxx>
   fs/xfs/xfs_log_recover.c, xlog_recover_add_to_cont_trans()

2. Logged superblock geometry installed without validation
   UBSAN shift-out-of-bounds via sb_inopblog
   Message-ID: <c31-xfs-logged-sb-geometry-20261107@xxxxxx>
   fs/xfs/xfs_buf_item_recover.c, xfs_sb_from_disk() +
   xfs_update_last_ag_size()

3. ilf_len used as buffer read length without requiring whole blocks
   KASAN slab-out-of-bounds in xfs_inode_buf_verify()
   Message-ID: <c34-xfs-ilf-len-oob-20261108@xxxxxx>
   fs/xfs/xfs_inode_item_recover.c:351

4. ilf_size read from a region shorter than the format header
   KASAN slab-out-of-bounds in xlog_recover_add_to_trans()
   Message-ID: <c37-xfs-ilf-size-short-region-20261109@xxxxxx>
   fs/xfs/xfs_log_recover.c, region collection stage

5. Buffer data map runs index ri_buf[] unchecked in
   do_inode_buffer()
   KASAN slab-out-of-bounds in xlog_recover_do_inode_buffer()
   Message-ID: <c40-xfs-inodebuf-item-index-20261109@xxxxxx>
   fs/xfs/xfs_buf_item_recover.c:625

6. The same unchecked source index in do_reg_buffer(), with the
   destination side already fixed by CVE-2026-80536
   KASAN slab-out-of-bounds in xlog_recover_do_reg_buffer()
   Message-ID: <c41-xfs-regbuf-run-index-20261109@xxxxxx>
   fs/xfs/xfs_buf_item_recover.c:464

Separately, ilf_boffset (report of 2026-10-31, bumped on 2026-11-08)
still has no bound and is a distinct issue from the six above:
   Message-ID: <x1-xfs-ilf-boffset-20261031@xxxxxx>

All seven reproduce at mount(2) from a crafted image, are deterministic,
and are unchanged in mainline as of 2026-11-09. Reproducers are
available on request. Happy to send any of them as a patch series
instead if that is preferred.

Thanks,
Guikun Yang