linux-kernel - Re: [PATCH] hfsplus: validate btree bitmap during mount and handle corruption gracefully

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202601251011.kJUhBF3P-lkp@intel.com>
Date: Sun, 25 Jan 2026 10:11:16 +0800
From: kernel test robot <lkp@...el.com>
To: Shardul Bankar <shardul.b@...ricsoftware.com>, slava@...eyko.com,
	glaubitz@...sik.fu-berlin.de, frank.li@...o.com,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
	syzbot+1c8ff72d0cd8a50dfeaa@...kaller.appspotmail.com,
	janak@...ricsoftware.com, shardulsb08@...il.com,
	Shardul Bankar <shardul.b@...ricsoftware.com>
Subject: Re: [PATCH] hfsplus: validate btree bitmap during mount and handle
 corruption gracefully

Hi Shardul,

kernel test robot noticed the following build warnings:

[auto build test WARNING on brauner-vfs/vfs.all]
[also build test WARNING on linus/master v6.19-rc6 next-20260123]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Shardul-Bankar/hfsplus-validate-btree-bitmap-during-mount-and-handle-corruption-gracefully/20260125-032702
base:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.all
patch link:    https://lore.kernel.org/r/20260124192501.748071-1-shardul.b%40mpiricsoftware.com
patch subject: [PATCH] hfsplus: validate btree bitmap during mount and handle corruption gracefully
config: hexagon-randconfig-001-20260125 (https://download.01.org/0day-ci/archive/20260125/202601251011.kJUhBF3P-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260125/202601251011.kJUhBF3P-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601251011.kJUhBF3P-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> fs/hfsplus/btree.c:180:17: warning: result of comparison of constant 262144 with expression of type 'u16' (aka 'unsigned short') is always false [-Wtautological-constant-out-of-range-compare]
     180 |             bitmap_off >= PAGE_SIZE)
         |             ~~~~~~~~~~ ^  ~~~~~~~~~
   1 warning generated.


vim +180 fs/hfsplus/btree.c

   131	
   132	/*
   133	 * Validate that node 0 (header node) is marked allocated in the bitmap.
   134	 * This is a fundamental invariant - node 0 must always be allocated.
   135	 * Returns true if corruption is detected (node 0 bit is unset).
   136	 * Note: head must be from kmap_local_page(page) that is still mapped.
   137	 * This function accesses the page through head pointer, so it must be
   138	 * called before kunmap_local(head).
   139	 */
   140	static bool hfsplus_validate_btree_bitmap(struct hfs_btree *tree,
   141						  struct hfs_btree_header_rec *head)
   142	{
   143		u8 *page_base;
   144		u16 rec_off_tbl_off;
   145		__be16 rec_data[2];
   146		u16 bitmap_off, bitmap_len;
   147		u8 *bitmap_ptr;
   148		u8 first_byte;
   149		unsigned int node_size = tree->node_size;
   150	
   151		/*
   152		 * Get base page pointer. head points to:
   153		 * kmap_local_page(page) + sizeof(struct hfs_bnode_desc)
   154		 */
   155		page_base = (u8 *)head - sizeof(struct hfs_bnode_desc);
   156	
   157		/*
   158		 * Calculate offset to record 2 entry in record offset table.
   159		 * Record offsets are at end of node: node_size - (rec_num + 2) * 2
   160		 * Record 2: (2+2)*2 = 8 bytes from end
   161		 */
   162		rec_off_tbl_off = node_size - (2 + 2) * 2;
   163	
   164		/* Only validate if record offset table is on the first page */
   165		if (rec_off_tbl_off + 4 > node_size || rec_off_tbl_off + 4 > PAGE_SIZE)
   166			return false; /* Skip validation if offset table not on first page */
   167	
   168		/* Read record 2 offset table entry (length and offset, both u16) */
   169		memcpy(rec_data, page_base + rec_off_tbl_off, 4);
   170		bitmap_off = be16_to_cpu(rec_data[1]);
   171		bitmap_len = be16_to_cpu(rec_data[0]) - bitmap_off;
   172	
   173		/*
   174		 * Validate bitmap offset is within node and after bnode_desc.
   175		 * Also ensure bitmap is on the first page.
   176		 */
   177		if (bitmap_len == 0 ||
   178		    bitmap_off < sizeof(struct hfs_bnode_desc) ||
   179		    bitmap_off >= node_size ||
 > 180		    bitmap_off >= PAGE_SIZE)
   181			return false; /* Skip validation if bitmap not accessible */
   182	
   183		/* Read first byte of bitmap */
   184		bitmap_ptr = page_base + bitmap_off;
   185		first_byte = bitmap_ptr[0];
   186	
   187		/* Check if node 0's bit (bit 7, MSB) is set */
   188		if (!(first_byte & 0x80))
   189			return true; /* Corruption detected */
   190	
   191		return false;
   192	}
   193	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki