linux-cve-announce - CVE-2025-38650: hfsplus: remove mutex_lock check in hfsplus_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025082237-CVE-2025-38650-48d6@gregkh>
Date: Fri, 22 Aug 2025 18:00:58 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38650: hfsplus: remove mutex_lock check in hfsplus_free_extents

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: remove mutex_lock check in hfsplus_free_extents

Syzbot reported an issue in hfsplus filesystem:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346
	hfsplus_free_extents+0x700/0xad0
Call Trace:
<TASK>
hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606
hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56
cont_expand_zero fs/buffer.c:2383 [inline]
cont_write_begin+0x2cf/0x860 fs/buffer.c:2446
hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52
generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347
hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263
notify_change+0xe38/0x10f0 fs/attr.c:420
do_truncate+0x1fb/0x2e0 fs/open.c:65
do_sys_ftruncate+0x2eb/0x380 fs/open.c:193
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock
on file truncation") unlock extree before hfsplus_free_extents(),
and add check wheather extree is locked in hfsplus_free_extents().

However, when operations such as hfsplus_file_release,
hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed
concurrently in different files, it is very likely to trigger the
WARN_ON, which will lead syzbot and xfstest to consider it as an
abnormality.

The comment above this warning also describes one of the easy
triggering situations, which can easily trigger and cause
xfstest&syzbot to report errors.

[task A]			[task B]
->hfsplus_file_release
  ->hfsplus_file_truncate
    ->hfs_find_init
      ->mutex_lock
    ->mutex_unlock
				->hfsplus_write_begin
				  ->hfsplus_get_block
				    ->hfsplus_file_extend
				      ->hfsplus_ext_read_extent
				        ->hfs_find_init
					  ->mutex_lock
    ->hfsplus_free_extents
      WARN_ON(mutex_is_locked) !!!

Several threads could try to lock the shared extents tree.
And warning can be triggered in one thread when another thread
has locked the tree. This is the wrong behavior of the code and
we need to remove the warning.

The Linux kernel CVE team has assigned CVE-2025-38650 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.1.148 with commit a19ce9230b22a0866313932e7964cf05557a6008
	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.6.102 with commit 084933961ecda7561dedfb78c4676ccb90c91ada
	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.12.42 with commit 5055b7db94110f228961dea6b74eed0a93a50b01
	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.15.10 with commit 9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f
	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.16.1 with commit 314310166ba1fdff7660dfd9d18ea42d7058f7ae
	Issue introduced in 4.19 with commit 31651c607151f1034cfb57e5a78678bea54c362b and fixed in 6.17-rc1 with commit fcb96956c921f1aae7e7b477f2435c56f77a31b4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38650
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/hfsplus/extents.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008
	https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada
	https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01
	https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f
	https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae
	https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4