linux-kernel - Re: [syzbot] [hfs?] WARNING in hfs_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <ab7a9477-ddc7-430f-b4ee-c67251e879b0@app.fastmail.com>
Date:   Wed, 04 Jan 2023 23:33:50 +0100
From:   "Arnd Bergmann" <arnd@...db.de>
To:     "Linus Torvalds" <torvalds@...ux-foundation.org>
Cc:     syzbot <syzbot+7bb7cd3595533513a9e7@...kaller.appspotmail.com>,
        "Andrew Morton" <akpm@...ux-foundation.org>,
        christian.brauner@...ntu.com,
        "Damien Le Moal" <damien.lemoal@...nsource.wdc.com>,
        jlayton@...nel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        "Matthew Wilcox" <willy@...radead.org>,
        ZhangPeng <zhangpeng362@...wei.com>,
        "Viacheslav Dubeyko" <slava@...eyko.com>,
        linux-m68k@...ts.linux-m68k.org
Subject: Re: [syzbot] [hfs?] WARNING in hfs_write_inode

On Wed, Jan 4, 2023, at 20:06, Linus Torvalds wrote:
>
> I suspect this code is basically all dead. From what I can tell, hfs
> only gets updates for
>
>  (a) syzbot reports
>
>  (b) vfs interface changes

There is clearly no new work going into it, and most data exchange
with MacOS would use HFS+, but I think there are still some users.

> and the last real changes seem to have been by Ernesto A. Fernández
> back in 2018.
>
> Hmm. Looking at that code, we have another bug in there, introduced by
> an earlier fix for a similar issue: commit 8d824e69d9f3 ("hfs: fix OOB
> Read in __hfs_brec_find") added
>
> +       if (HFS_I(main_inode)->cat_key.CName.len > HFS_NAMELEN)
> +               return -EIO;
>
> but it's after hfs_find_init(), so it should actually have done a
> hfs_find_exit() to not leak memory.
>
> So we should probably fix that too.
>
> Something like this ENTIRELY UNTESTED patch?
>
> Do we have anybody who looks at hfs?

Adding Viacheslav Dubeyko to Cc, he's at least been reviewing
patches for HFS and HFS+ somewhat recently. The linux-m68k
list may have some users dual-booting old MacOS.

Viacheslav, see the start of the thread at
https://lore.kernel.org/lkml/000000000000dbce4e05f170f289@google.com/

     Arnd