From nobody Tue Sep 29 09:08:37 2026 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43F0A37A840 for ; Mon, 10 Aug 2026 09:24:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786353871; cv=none; b=mKmHSo33ciJbnhWmRTEpsOjVSU8tQfmTc+6sjwTfF5fkKO/rQ0IIvTqxEkquVqPbR6LcHW+FCiG/FA9h9xAPZCvQeJY8RRT+0yJnE0FtIbFtFF8aG74Wd74Nix6Fq4A/nxonUvmv+hKjvX5pv8DTzSupyUij/pFXI7Mtw4cIoGM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786353871; c=relaxed/simple; bh=/qBC/7mUgpptEqXEahTihgpIWaLMGVOgudQpjF6Pjxk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Isc99GMLrjfkNkoVyBeMueBq5OoVvXFW5/qCAK+2RnSK2spGkVTNMAozOGsV7078ypAECmu0EaWFjUFscxXw8g6sI8mmperOLfXGn1YjuN9MTwc62Hl1Fx6Gh+aBaOX8rWd0KxbvbYgBmouwESo3YFssS9wWmNNqu5LqKF8zkEQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JZMKFcP4; arc=none smtp.client-ip=209.85.215.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JZMKFcP4" Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cbb7926836eso987399a12.3 for ; Mon, 10 Aug 2026 02:24:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786353869; x=1786958669; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k7ldNj0eJUVnWcxlhmWvzp8Wx4neTsZd5jvrWXN9nzg=; b=JZMKFcP4qhtrmWDv09CHe9FLSaOmbFRnt4f0g5sK1f8bR1LIxuR4qdPZG6VYTpG2t/ bJf6bAiic1nBzyEWUEbDoXGm1ln0gkbDzyTxpB/63osh4fc8z5dwQprlNGym6Pno40sq ogKTn/ewXJyav48IwxIGr/jmwZpZXDbAxrAs/mHIyKZTslfwkqT9qRCIFOwUgSQ9oEPI SL3qDKV1H+9ZWVCTAdWnehTYyP8JPfQe8zVJ/IJUtxLJ4P3d97wluD4vynzKKnPgMuI9 WV5djVHgmJBE0toKoguuw8YrpinZsM3atVKyPoasUJAhvfiYpRmhqWfqpENcTHnHD5Xr Zx3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786353869; x=1786958669; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=k7ldNj0eJUVnWcxlhmWvzp8Wx4neTsZd5jvrWXN9nzg=; b=DMzPvSaPzoUnAyak7C3bNiT/Nu7klPNDl8Yw0tBY1brI9I6NjppHpgdVX4sJDMonKS ad1gUxA2VYVW/QYcxuRU25iNUqlFokKbqXP0zIYX17oZukaTY4ljuctEaaqDNpuICVsU ftml2hCTVp5DSqfaHEw7V5z6dzBBSD3pAjPlmw5/lo2wqwcr7d2b1z5Z8GUU0DEmAzuf IrZ0OzUmwWF8pOCbqLpESlmlimsn9UlbH4mg19J/0GkU9FK8troy1h8/qRN5TbTQ/eyU 0MtTTGUImwjBWdO8ifulhhkqS60aHNM7i8HKU+5j8hqXoOt6XRywQXqcIz7U52wKVzdd Esmg== X-Forwarded-Encrypted: i=1; AHgh+RoerSB2XQht+lujvmPC0db6StfZOLGqLJaJZsGdzUu8pipX3/oZM/inhdc0S9Ia//EG+0IjxZgXgPFLGus=@vger.kernel.org X-Gm-Message-State: AOJu0YwuneNeux9hoUI6zHKWdNVzrwOWWxB9ioa36DSR7Q920cW9T0hk cahJjS4bTN1R0UaSTEZrwny57pvrWv81Vaxy6j+9Sy4uSE1epxj7ePsj X-Gm-Gg: AR+sD10HZUExej8Se8K/hTzMHrXzlMc3jY2suEF3Y1wYvovfeHBJLj78WLdJ54+ZKFv zAY6I8Vru+u8X8oh9mtDn3ciXRGJwohRt0981ZLrb8d44tpGvZ8hWiGckHfdQNo7ADgNaA61+vE 19ZfdMnvl1cOU4YF/KBQTWzAoesVdj7fl3GFg4BigQ+D1zbH7JWI8aYYJmyBF2AtMfqp0/a/KY7 013Q1dJsl7FJEUmKui4npCzqqEgByxVuJA/3nXMrjT7cfVlAGHYvKDiJrwtyr2UhQykYLniAF3o KdmBa0lKeJZu5FuGQ1x4GjofaKSZVRexmq5SiXjbTrgBUb4naPd6DdNae5Y5d4KuBMl676eYJnU R6OYU0ZhbIolrBbJHlry+xgpniRqix95Q4cdwueKhtEK6sCu8HiYmfaNdBoEv7PyPA7tWaViAMt LTwKEJSeyWymhpK5Nr4z1yCMSBypHvTFFfeNkEYmhmLV17bPA+xw8zAGDzZFbPd97jLKS/Xh4= X-Received: by 2002:a05:6a00:3992:b0:84c:2e2d:57b with SMTP id d2e1a72fcca58-84f2e05d4b1mr40600740b3a.27.1786353869198; Mon, 10 Aug 2026 02:24:29 -0700 (PDT) Received: from ustb520lab-MS-7E07.. ([115.25.44.221]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f38b7d9sm3562009a12.32.2026.08.10.02.24.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 02:24:28 -0700 (PDT) From: Jiaming Zhang To: slava@dubeyko.com Cc: frank.li@vivo.com, glaubitz@physik.fu-berlin.de, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, r772577952@gmail.com, syzkaller@googlegroups.com, vdubeyko@coreweave.com Subject: [PATCH] hfsplus: validate extent record length before writing it back Date: Mon, 10 Aug 2026 17:24:21 +0800 Message-ID: <20260810092422.1691377-1-r772577952@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <0720c3ba6399c11a0a328e8d8eef99a19e6999c8.camel@dubeyko.com> References: <0720c3ba6399c11a0a328e8d8eef99a19e6999c8.camel@dubeyko.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" __hfsplus_ext_write_extent() writes the cached extent record back into a B-tree node using fd->entrylength as the length, and fd->entrylength is derived in __hfs_brec_find() from two on-disk values: fd->entrylength =3D len - keylen; A crafted image can keep both len and keylen valid but make fd->entrylength negative (keylen > len). __hfsplus_ext_write_extent() doesn't check fd->entrylength before consuming it, and hfs_bnode_write() takes the length as u32, so the negative value turns into a huge one. The copy then reads data past the end of hip->cached_extents, which is only sizeof(hfsplus_extent_rec) bytes long, and leaks kernel memory into the image. Reject an fd->entrylength that does not match sizeof(hfsplus_extent_rec) in __hfsplus_ext_write_extent(), mirroring the check already performed in __hfsplus_ext_read_extent(). Link: https://lore.kernel.org/lkml/cbd7003314c530d4f910eacf019ff80adad6687e= .camel@dubeyko.com/ Signed-off-by: Jiaming Zhang Reviewed-by: Viacheslav Dubeyko --- fs/hfsplus/extents.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c index 813e68b8ecd6..eb7c11524d18 100644 --- a/fs/hfsplus/extents.c +++ b/fs/hfsplus/extents.c @@ -110,6 +110,8 @@ static int __hfsplus_ext_write_extent(struct inode *ino= de, } else { if (res) return res; + if (fd->entrylength !=3D sizeof(hfsplus_extent_rec)) + return -EIO; hfs_bnode_write(fd->bnode, hip->cached_extents, fd->entryoffset, fd->entrylength); hip->extent_state &=3D ~HFSPLUS_EXT_DIRTY; --=20 2.43.0