For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] hfs: return error when bnode already hashed in
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
hfs_bnode_create
hfs_bnode_create() checks if the requested node number is already
present in the B-tree hash table. If it is, the function emits a
WARN_ON(1) and returns the existing node:
if (node) {
pr_crit("new node %u already hashed?\n", num);
WARN_ON(1);
return node;
}
On crafted HFS images with inconsistent B-tree bitmap data, the
allocator can repeatedly request creation of node 0 which is
already hashed, triggering this WARNING reliably on every mkdir.
Replace the WARN_ON with an error return. The node being already
hashed when creation is requested indicates filesystem corruption
-- returning ERR_PTR(-EIO) allows the caller to handle this
gracefully rather than generating a kernel stack trace.
Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/hfs/bnode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -517,8 +517,8 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
spin_unlock(&tree->hash_lock);
if (node) {
pr_crit("new node %u already hashed?\n", num);
- WARN_ON(1);
- return node;
+ return ERR_PTR(-EIO);
}
node = __hfs_bnode_create(tree, num);
if (!node)
--
2.43.0