linux-kernel - RE: [PATCH v3] hfs: remove BUG() from hfs_release_folio()/hfs_test_inode()/hfs_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5684510c160d08680f4c35b2f70881edc53e83aa.camel@ibm.com>
Date: Thu, 17 Jul 2025 19:49:41 +0000
From: Viacheslav Dubeyko <Slava.Dubeyko@....com>
To: "willy@...radead.org" <willy@...radead.org>,
        "penguin-kernel@...ove.sakura.ne.jp" <penguin-kernel@...ove.sakura.ne.jp>
CC: "glaubitz@...sik.fu-berlin.de" <glaubitz@...sik.fu-berlin.de>,
        "frank.li@...o.com" <frank.li@...o.com>,
        "slava@...eyko.com"
	<slava@...eyko.com>,
        "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "akpm@...ux-foundation.org"
	<akpm@...ux-foundation.org>
Subject: RE: [PATCH v3] hfs: remove BUG() from
 hfs_release_folio()/hfs_test_inode()/hfs_write_inode()

On Thu, 2025-07-17 at 20:35 +0100, Matthew Wilcox wrote:
> On Fri, Jul 18, 2025 at 12:32:46AM +0900, Tetsuo Handa wrote:
> > +++ b/fs/hfs/inode.c
> > @@ -81,7 +81,8 @@ static bool hfs_release_folio(struct folio *folio, gfp_t mask)
> >  		tree = HFS_SB(sb)->cat_tree;
> >  		break;
> >  	default:
> > -		BUG();
> > +		pr_err("detected unknown inode %lu, running fsck.hfs is recommended.\n",
> > +		       inode->i_ino);
> 
> As I asked the first time, how can we get here?  In order to release a
> folio, we have to first populate the pagecache of the inode with folios.
> How did we manage to do that for an inode with a bogus i_ino?
> 

Probably, we have not checked the inode ID at first place in hfs_read_inode()
[1]. So, it makes sense to rework the logic here.

> > @@ -441,7 +442,8 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
> >  			hfs_btree_write(HFS_SB(inode->i_sb)->cat_tree);
> >  			return 0;
> >  		default:
> > -			BUG();
> > +			pr_err("detected unknown inode %lu, running fsck.hfs is recommended.\n",
> > +			       inode->i_ino);
> 
> Similarly here, how did we manage to mark a bad inode as dirty?

I assume if we created the inode as normal with i_ino == 0, then we can make it
as a dirty. Because, inode will be made as bad inode here [2] only if rec->type
is invalid. But if it is valid, then we can create the normal inode even with
i_ino == 0.

It is my current understanding of the situation here. Tetsuo, please, correct me
if I am wrong.

Thanks,
Slava.

[1] https://elixir.bootlin.com/linux/v6.16-rc6/source/fs/hfs/inode.c#L350
[2] https://elixir.bootlin.com/linux/v6.16-rc6/source/fs/hfs/inode.c#L373