linux-kernel - Re: [PATCH] hfs: Prevent the use of bnodes without entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0ead1ebdbbecc1802e3ffed0867ba6a2c567e415.camel@ibm.com>
Date: Thu, 24 Jul 2025 20:06:20 +0000
From: Viacheslav Dubeyko <Slava.Dubeyko@....com>
To: "syzbot+41ba9c82bce8d7101765@...kaller.appspotmail.com"
	<syzbot+41ba9c82bce8d7101765@...kaller.appspotmail.com>,
        "eadavis@...com"
	<eadavis@...com>
CC: "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>,
        "frank.li@...o.com" <frank.li@...o.com>,
        "glaubitz@...sik.fu-berlin.de"
	<glaubitz@...sik.fu-berlin.de>,
        "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "slava@...eyko.com" <slava@...eyko.com>
Subject: Re:  [PATCH] hfs: Prevent the use of bnodes without entries

On Thu, 2025-07-24 at 23:08 +0800, Edward Adam Davis wrote:
> If the number of entries in the bnode is 0, the bnode is considered
> invalid.
> 
> Reported-by: syzbot+41ba9c82bce8d7101765@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=41ba9c82bce8d7101765  
> Tested-by: syzbot+41ba9c82bce8d7101765@...kaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@...com>
> ---
>  fs/hfs/bfind.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
> index ef9498a6e88a..1d6f2bbafa7a 100644
> --- a/fs/hfs/bfind.c
> +++ b/fs/hfs/bfind.c
> @@ -133,6 +133,8 @@ int hfs_brec_find(struct hfs_find_data *fd)
>  			goto invalid;
>  		if (bnode->type != (--height ? HFS_NODE_INDEX : HFS_NODE_LEAF))
>  			goto invalid;
> +		if (!bnode->num_recs)
> +			goto invalid;

If b-tree node hasn't records, then it doesn't mean that it's invalid. Because,
if we go into invalid way, then we show the message that node is corrupted [1]:

invalid:
	pr_err("inconsistency in B*Tree (%d,%d,%d,%u,%u)\n",
	       height, bnode->height, bnode->type, nidx, parent);
	res = -EIO;

But it is not true because the node simply has no records. It could be invalid
if bnode->num_recs < 0.

Also, I've sent the patch [2] already. I believe it should fix the issue. Am I
wrong here?

Thanks,
Slava.

[1] https://elixir.bootlin.com/linux/v6.16-rc6/source/fs/hfs/bfind.c#L152
[2]
https://lore.kernel.org/linux-fsdevel/20250703214912.244138-1-slava@dubeyko.com/

>  		bnode->parent = parent;
>  
>  		res = __hfs_brec_find(bnode, fd);