xfs: fix log recovery buffer allocation for the legacy h_size fixup

jira LE-2015
cve CVE-2024-39472
Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4
commit-author Christoph Hellwig <hch@lst.de>
commit 45cf976
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/45cf9760.failed

Commit a70f9fe ("xfs: detect and handle invalid iclog size set by
mkfs") added a fixup for incorrect h_size values used for the initial
umount record in old xfsprogs versions.  Later commit 0c771b9
("xfs: clean up calculation of LR header blocks") cleaned up the log
reover buffer calculation, but stoped using the fixed up h_size value
to size the log recovery buffer, which can lead to an out of bounds
access when the incorrect h_size does not come from the old mkfs
tool, but a fuzzer.

Fix this by open coding xlog_logrec_hblks and taking the fixed h_size
into account for this calculation.

Fixes: 0c771b9 ("xfs: clean up calculation of LR header blocks")
	Reported-by: Sam Sun <samsun1006219@gmail.com>
	Signed-off-by: Christoph Hellwig <hch@lst.de>
	Reviewed-by: Brian Foster <bfoster@redhat.com>
	Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
	Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>
(cherry picked from commit 45cf976)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

# Conflicts:
#	fs/xfs/xfs_log_recover.c

Author: PlaidCat

ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/45cf9760.failed

@@ -0,0 +1,66 @@
+xfs: fix log recovery buffer allocation for the legacy h_size fixup
+
+jira LE-2015
+cve CVE-2024-39472
+Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4
+commit-author Christoph Hellwig <hch@lst.de>
+commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-427.42.1.el9_4/45cf9760.failed
+
+Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by
+mkfs") added a fixup for incorrect h_size values used for the initial
+umount record in old xfsprogs versions.  Later commit 0c771b99d6c9
+("xfs: clean up calculation of LR header blocks") cleaned up the log
+reover buffer calculation, but stoped using the fixed up h_size value
+to size the log recovery buffer, which can lead to an out of bounds
+access when the incorrect h_size does not come from the old mkfs
+tool, but a fuzzer.
+
+Fix this by open coding xlog_logrec_hblks and taking the fixed h_size
+into account for this calculation.
+
+Fixes: 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks")
+	Reported-by: Sam Sun <samsun1006219@gmail.com>
+	Signed-off-by: Christoph Hellwig <hch@lst.de>
+	Reviewed-by: Brian Foster <bfoster@redhat.com>
+	Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
+	Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>
+(cherry picked from commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	fs/xfs/xfs_log_recover.c
+diff --cc fs/xfs/xfs_log_recover.c
+index 82c81d20459d,bb8957927c3c..000000000000
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@@ -3015,10 -3055,19 +3015,26 @@@ xlog_do_recovery_pass
+  		if (error)
+  			goto bread_err1;
+  
+++<<<<<<< HEAD
+ +		hblks = xlog_logrec_hblks(log, rhead);
+ +		if (hblks != 1) {
+ +			kmem_free(hbp);
+ +			hbp = xlog_alloc_buffer(log, hblks);
+++=======
++ 		/*
++ 		 * This open codes xlog_logrec_hblks so that we can reuse the
++ 		 * fixed up h_size value calculated above.  Without that we'd
++ 		 * still allocate the buffer based on the incorrect on-disk
++ 		 * size.
++ 		 */
++ 		if (h_size > XLOG_HEADER_CYCLE_SIZE &&
++ 		    (rhead->h_version & cpu_to_be32(XLOG_VERSION_2))) {
++ 			hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE);
++ 			if (hblks > 1) {
++ 				kvfree(hbp);
++ 				hbp = xlog_alloc_buffer(log, hblks);
++ 			}
+++>>>>>>> 45cf976008dd (xfs: fix log recovery buffer allocation for the legacy h_size fixup)
+  		}
+  	} else {
+  		ASSERT(log->l_sectBBsize == 1);
+* Unmerged path fs/xfs/xfs_log_recover.c