hfs_bnode_create() checks if the requested node number is already
present in the B-tree hash table.  If it is, the function emits a
WARN_ON(1) and returns the existing node:

    if (node) {
        pr_crit("new node %u already hashed?\n", num);
        WARN_ON(1);
        return node;
    }

On crafted HFS images with inconsistent B-tree bitmap data, the
allocator can repeatedly request creation of node 0 which is
already hashed, triggering this WARNING reliably on every mkdir.

Replace the WARN_ON with an error return.  The node being already
hashed when creation is requested indicates filesystem corruption
-- returning ERR_PTR(-EIO) allows the caller to handle this
gracefully rather than generating a kernel stack trace.

Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Tested-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfs/bnode.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index e8cd1a31f247..69895ccf81ef 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -517,8 +517,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	spin_unlock(&tree->hash_lock);
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
-		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EIO);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)
-- 
2.47.3

On Fri, 2026-04-17 at 18:59 +0000, Tristan Madani wrote:
> hfs_bnode_create() checks if the requested node number is already
> present in the B-tree hash table.  If it is, the function emits a
> WARN_ON(1) and returns the existing node:
> 
>     if (node) {
>         pr_crit("new node %u already hashed?\n", num);
>         WARN_ON(1);
>         return node;
>     }
> 
> On crafted HFS images with inconsistent B-tree bitmap data, the
> allocator can repeatedly request creation of node 0 which is
> already hashed, triggering this WARNING reliably on every mkdir.
> 
> Replace the WARN_ON with an error return.  The node being already
> hashed when creation is requested indicates filesystem corruption
> -- returning ERR_PTR(-EIO) allows the caller to handle this
> gracefully rather than generating a kernel stack trace.
> 
> Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
> Tested-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  fs/hfs/bnode.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
> index e8cd1a31f247..69895ccf81ef 100644
> --- a/fs/hfs/bnode.c
> +++ b/fs/hfs/bnode.c
> @@ -517,8 +517,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
>  	spin_unlock(&tree->hash_lock);
>  	if (node) {
>  		pr_crit("new node %u already hashed?\n", num);
> -		WARN_ON(1);
> -		return node;
> +		return ERR_PTR(-EIO);

We return -EEXISTS in HFS+ because it is the case of node existence [1].

This issue takes place because of node 0 has been set in bitmap as not
available. However, every HFS/HFS+ b-tree must have this node. We already
implemented this check for HFS+. I would like to ask you to port this check for
the case of HFS [2].

Thanks,
Slava.

>  	}
>  	node = __hfs_bnode_create(tree, num);
>  	if (!node)

[1]
https://lore.kernel.org/linux-fsdevel/08e7f7ef7da57448945a8d62160d2d7a67df2883.camel@ibm.com/
[2]
https://lore.kernel.org/linux-fsdevel/43be87e694ed6fe291990226624559e7f01820d9.camel@dubeyko.com/