fs/hfs/btree.c | 11 ++++++++--- fs/hfsplus/btree.c | 11 ++++++++--- 2 files changed, 16 insertions(+), 6 deletions(-)
From: Kyle Zeng <kylebot@openai.com>
From: Kyle Zeng <kylebot@openai.com>
B-tree nodes with a zero reference count remain in the node hash until
folio reclaim or tree teardown frees them. The folio release callbacks
remove nodes while holding hash_lock, but hfs_btree_close() walks and
frees the same hash without that lock. Reclaim can therefore unhash and
free a node after close has loaded its pointer, causing a use-after-free
or double-free.
Detach each node with hfs_bnode_unhash() while holding hash_lock before
inspecting and freeing it. Drop the lock before hfs_bnode_free() so a
large tree is not freed while holding a spinlock. Apply the same fix to
the matching HFS+ implementation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
fs/hfs/btree.c | 11 ++++++++---
fs/hfsplus/btree.c | 11 ++++++++---
2 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 41b4e8fc9..d85a1df9f 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -310,14 +310,19 @@ void hfs_btree_close(struct hfs_btree *tree)
return;
for (i = 0; i < NODE_HASH_SIZE; i++) {
- while ((node = tree->node_hash[i])) {
- tree->node_hash[i] = node->next_hash;
+ for (;;) {
+ spin_lock(&tree->hash_lock);
+ node = tree->node_hash[i];
+ if (node)
+ hfs_bnode_unhash(node);
+ spin_unlock(&tree->hash_lock);
+ if (!node)
+ break;
if (atomic_read(&node->refcnt))
pr_err("node %d:%d still has %d user(s)!\n",
node->tree->cnid, node->this,
atomic_read(&node->refcnt));
hfs_bnode_free(node);
- tree->node_hash_cnt--;
}
}
iput(tree->inode);
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 2ea8cd565..a90c9f416 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -417,15 +417,20 @@ void hfs_btree_close(struct hfs_btree *tree)
return;
for (i = 0; i < NODE_HASH_SIZE; i++) {
- while ((node = tree->node_hash[i])) {
- tree->node_hash[i] = node->next_hash;
+ for (;;) {
+ spin_lock(&tree->hash_lock);
+ node = tree->node_hash[i];
+ if (node)
+ hfs_bnode_unhash(node);
+ spin_unlock(&tree->hash_lock);
+ if (!node)
+ break;
if (atomic_read(&node->refcnt))
pr_crit("node %d:%d "
"still has %d user(s)!\n",
node->tree->cnid, node->this,
atomic_read(&node->refcnt));
hfs_bnode_free(node);
- tree->node_hash_cnt--;
}
}
iput(tree->inode);On Fri, 2026-09-18 at 15:08 +0200, Bruno Produit wrote:
> From: Kyle Zeng <kylebot@openai.com>
>
> From: Kyle Zeng <kylebot@openai.com>
Why do we have the same email two times here? :)
>
> B-tree nodes with a zero reference count remain in the node hash
> until
> folio reclaim or tree teardown frees them. The folio release
> callbacks
> remove nodes while holding hash_lock, but hfs_btree_close() walks and
> frees the same hash without that lock. Reclaim can therefore unhash
> and
> free a node after close has loaded its pointer, causing a use-after-
> free
> or double-free.
>
> Detach each node with hfs_bnode_unhash() while holding hash_lock
> before
> inspecting and freeing it. Drop the lock before hfs_bnode_free() so
> a
> large tree is not freed while holding a spinlock. Apply the same fix
> to
> the matching HFS+ implementation.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
I think we need to have Cc: stable@vger.kernel.org here too.
> Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
> Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
> Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
> Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
> Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
Does this fix really eliminates these reported issues? Have you tested
all of these cases? It will be great to have this clarification in the
commit message.
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
> ---
> fs/hfs/btree.c | 11 ++++++++---
> fs/hfsplus/btree.c | 11 ++++++++---
> 2 files changed, 16 insertions(+), 6 deletions(-)
>
> diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
> index 41b4e8fc9..d85a1df9f 100644
> --- a/fs/hfs/btree.c
> +++ b/fs/hfs/btree.c
> @@ -310,14 +310,19 @@ void hfs_btree_close(struct hfs_btree *tree)
> return;
>
> for (i = 0; i < NODE_HASH_SIZE; i++) {
> - while ((node = tree->node_hash[i])) {
> - tree->node_hash[i] = node->next_hash;
> + for (;;) {
I really dislike this infinite loop pattern. Could we have a loop is
limited by some value?
> + spin_lock(&tree->hash_lock);
> + node = tree->node_hash[i];
> + if (node)
> + hfs_bnode_unhash(node);
> + spin_unlock(&tree->hash_lock);
> + if (!node)
> + break;
> if (atomic_read(&node->refcnt))
> pr_err("node %d:%d still has %d
> user(s)!\n",
> node->tree->cnid, node->this,
> atomic_read(&node->refcnt));
> hfs_bnode_free(node);
> - tree->node_hash_cnt--;
> }
> }
> iput(tree->inode);
> diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
> index 2ea8cd565..a90c9f416 100644
> --- a/fs/hfsplus/btree.c
> +++ b/fs/hfsplus/btree.c
> @@ -417,15 +417,20 @@ void hfs_btree_close(struct hfs_btree *tree)
> return;
>
> for (i = 0; i < NODE_HASH_SIZE; i++) {
> - while ((node = tree->node_hash[i])) {
> - tree->node_hash[i] = node->next_hash;
> + for (;;) {
Ditto.
Thanks,
Slava.
> + spin_lock(&tree->hash_lock);
> + node = tree->node_hash[i];
> + if (node)
> + hfs_bnode_unhash(node);
> + spin_unlock(&tree->hash_lock);
> + if (!node)
> + break;
> if (atomic_read(&node->refcnt))
> pr_crit("node %d:%d "
> "still has %d
> user(s)!\n",
> node->tree->cnid, node-
> >this,
> atomic_read(&node->refcnt));
> hfs_bnode_free(node);
> - tree->node_hash_cnt--;
> }
> }
> iput(tree->inode);
On Fri, Sep 18, 2026 at 9:57 PM Viacheslav Dubeyko <slava@dubeyko.com> wrote:
>
> On Fri, 2026-09-18 at 15:08 +0200, Bruno Produit wrote:
> > From: Kyle Zeng <kylebot@openai.com>
> >
> > From: Kyle Zeng <kylebot@openai.com>
>
> Why do we have the same email two times here? :)
>
Sorry for the mix-up, I was unsure about git send-email.
> >
> > B-tree nodes with a zero reference count remain in the node hash
> > until
> > folio reclaim or tree teardown frees them. The folio release
> > callbacks
> > remove nodes while holding hash_lock, but hfs_btree_close() walks and
> > frees the same hash without that lock. Reclaim can therefore unhash
> > and
> > free a node after close has loaded its pointer, causing a use-after-
> > free
> > or double-free.
> >
> > Detach each node with hfs_bnode_unhash() while holding hash_lock
> > before
> > inspecting and freeing it. Drop the lock before hfs_bnode_free() so
> > a
> > large tree is not freed while holding a spinlock. Apply the same fix
> > to
> > the matching HFS+ implementation.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>
> I think we need to have Cc: stable@vger.kernel.org here too.
>
Added to CC
> > Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
> > Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
> > Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
> > Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
> > Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
>
> Does this fix really eliminates these reported issues? Have you tested
> all of these cases? It will be great to have this clarification in the
> commit message.
>
These crashes do not have test cases to reproduce as far as i
understand (nothing in the repro columns). They do all seem to be the
same UAF in the {hfs,hfsplus}_btree_close() (or
{hfs,hfsplus}_bnode_unhash()) and follow the same pattern, which is
why I included them. Let me know if I should remove this :)
> > Assisted-by: Codex:gpt-5.6-sol
> > Signed-off-by: Kyle Zeng <kylebot@openai.com>
> > Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
> > ---
> > fs/hfs/btree.c | 11 ++++++++---
> > fs/hfsplus/btree.c | 11 ++++++++---
> > 2 files changed, 16 insertions(+), 6 deletions(-)
> >
> > diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
> > index 41b4e8fc9..d85a1df9f 100644
> > --- a/fs/hfs/btree.c
> > +++ b/fs/hfs/btree.c
> > @@ -310,14 +310,19 @@ void hfs_btree_close(struct hfs_btree *tree)
> > return;
> >
> > for (i = 0; i < NODE_HASH_SIZE; i++) {
> > - while ((node = tree->node_hash[i])) {
> > - tree->node_hash[i] = node->next_hash;
> > + for (;;) {
>
> I really dislike this infinite loop pattern. Could we have a loop is
> limited by some value?
>
I'll send a new patch removing this pattern and keeping the while loop.
> > + spin_lock(&tree->hash_lock);
> > + node = tree->node_hash[i];
> > + if (node)
> > + hfs_bnode_unhash(node);
> > + spin_unlock(&tree->hash_lock);
> > + if (!node)
> > + break;
> > if (atomic_read(&node->refcnt))
> > pr_err("node %d:%d still has %d
> > user(s)!\n",
> > node->tree->cnid, node->this,
> > atomic_read(&node->refcnt));
> > hfs_bnode_free(node);
> > - tree->node_hash_cnt--;
> > }
> > }
> > iput(tree->inode);
> > diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
> > index 2ea8cd565..a90c9f416 100644
> > --- a/fs/hfsplus/btree.c
> > +++ b/fs/hfsplus/btree.c
> > @@ -417,15 +417,20 @@ void hfs_btree_close(struct hfs_btree *tree)
> > return;
> >
> > for (i = 0; i < NODE_HASH_SIZE; i++) {
> > - while ((node = tree->node_hash[i])) {
> > - tree->node_hash[i] = node->next_hash;
> > + for (;;) {
>
> Ditto.
>
> Thanks,
> Slava.
>
> > + spin_lock(&tree->hash_lock);
> > + node = tree->node_hash[i];
> > + if (node)
> > + hfs_bnode_unhash(node);
> > + spin_unlock(&tree->hash_lock);
> > + if (!node)
> > + break;
> > if (atomic_read(&node->refcnt))
> > pr_crit("node %d:%d "
> > "still has %d
> > user(s)!\n",
> > node->tree->cnid, node-
> > >this,
> > atomic_read(&node->refcnt));
> > hfs_bnode_free(node);
> > - tree->node_hash_cnt--;
> > }
> > }
> > iput(tree->inode);
>
© 2016 - 2026 Red Hat, Inc.