[PATCH] erofs-utils: lib: check NULL from erofs_rebuild_get_dentry()

[PATCH] erofs-utils: lib: check NULL from erofs_rebuild_get_dentry()

[Vansh Choudhary]

erofs_rebuild_get_dentry() returns NULL when the input path
normalizes to nothing (".", "/", "//", or paths that collapse via
".."). The tar hardlink branch and the S3 import loop only check
IS_ERR() and then dereference the result.

Reject a hardlink target that resolves to root with -EISDIR, and
treat a root-normalized S3 key as the root inode itself.

Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
Fixes: 29728ba8f6f6 ("erofs-utils: mkfs: support EROFS meta-only image generation from S3")
Signed-off-by: Vansh Choudhary <ch@vnsh.in>
---
 lib/remotes/s3.c | 5 ++++-
 lib/tar.c        | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/remotes/s3.c b/lib/remotes/s3.c
index e552ed0..d386a32 100644
--- a/lib/remotes/s3.c
+++ b/lib/remotes/s3.c
@@ -1129,7 +1129,10 @@ int s3erofs_build_trees(struct erofs_importer *im, struct erofs_s3 *s3,
 			ret = PTR_ERR(d);
 			goto err_iter;
 		}
-		if (d->type == EROFS_FT_DIR) {
+		if (!d) {
+			inode = root;
+			inode->i_mode = S_IFDIR | 0755;
+		} else if (d->type == EROFS_FT_DIR) {
 			inode = d->inode;
 			inode->i_mode = S_IFDIR | 0755;
 		} else {
diff --git a/lib/tar.c b/lib/tar.c
index d2dc141..b08bd77 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -1024,6 +1024,10 @@ out_eot:
 			ret = PTR_ERR(d2);
 			goto out;
 		}
+		if (!d2) {
+			ret = -EISDIR;
+			goto out;
+		}
 		if (d2->type == EROFS_FT_UNKNOWN) {
 			ret = -ENOENT;
 			goto out;
-- 
2.43.0

Re: [PATCH] erofs-utils: lib: check NULL from erofs_rebuild_get_dentry()

[Gao Xiang]

On 2026/4/21 01:47, Vansh Choudhary wrote:
> erofs_rebuild_get_dentry() returns NULL when the input path
> normalizes to nothing (".", "/", "//", or paths that collapse via
> ".."). The tar hardlink branch and the S3 import loop only check
> IS_ERR() and then dereference the result.
> 
> Reject a hardlink target that resolves to root with -EISDIR, and
> treat a root-normalized S3 key as the root inode itself.
> 
> Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
> Fixes: 29728ba8f6f6 ("erofs-utils: mkfs: support EROFS meta-only image generation from S3")
> Signed-off-by: Vansh Choudhary <ch@vnsh.in>

Need a reproducer to experimental-tests before advancing this.

Thanks,
Gao Xiang

[PATCH] erofs-utils: tests: add test for hardlink-to-root tar entries

[Vansh Choudhary]

This is a regression test for "erofs-utils: lib: check NULL from
erofs_rebuild_get_dentry()".

Signed-off-by: Vansh Choudhary <ch@vnsh.in>
---
 tests/Makefile.am   |  3 +++
 tests/erofs/031     | 58 +++++++++++++++++++++++++++++++++++++++++++++
 tests/erofs/031.out |  2 ++
 3 files changed, 63 insertions(+)
 create mode 100755 tests/erofs/031
 create mode 100644 tests/erofs/031.out

diff --git a/tests/Makefile.am b/tests/Makefile.am
index d8ac067..e7eacbe 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -126,6 +126,9 @@ TESTS += erofs/028
 # 029 - test FUSE daemon and kernel error handling on corrupted inodes
 TESTS += erofs/029
 
+# 031 - regression test for NULL dentry on hardlink-to-root tar entry
+TESTS += erofs/031
+
 # NEW TEST CASE HERE
 # TESTS += erofs/999
 
diff --git a/tests/erofs/031 b/tests/erofs/031
new file mode 100755
index 0000000..79f2a3e
--- /dev/null
+++ b/tests/erofs/031
@@ -0,0 +1,58 @@
+#!/bin/sh
+# SPDX-License-Identifier: MIT
+#
+# regression test for a NULL dentry crash in mkfs.erofs --tar when
+# a tar hardlink entry's linkname resolves to the root directory
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$(echo $0 | awk '{print $((NF-1))"/"$NF}' FS="/")
+
+# get standard environment, filters and checks
+. "${srcdir}/common/rc"
+
+cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+echo "QA output created by $seq"
+
+if [ -z $SCRATCH_DEV ]; then
+	SCRATCH_DEV=$tmp/erofs_$seq.img
+	rm -f $SCRATCH_DEV
+fi
+
+localdir="$tmp/$seq"
+rm -rf $localdir
+mkdir -p $localdir
+
+# two empty regular files; tar lays the second header at offset 512.
+: > $localdir/a
+: > $localdir/b
+(cd $localdir && tar --format=ustar -cf $tmp.tar a b) || \
+	_fail "failed to build input tar"
+
+# rewrite the second entry as a hardlink whose target is "."
+printf '1' | dd of=$tmp.tar bs=1 seek=668 count=1 conv=notrunc 2>/dev/null
+printf '.' | dd of=$tmp.tar bs=1 seek=669 count=1 conv=notrunc 2>/dev/null
+dd if=/dev/zero of=$tmp.tar bs=1 seek=670 count=99 conv=notrunc 2>/dev/null
+
+# recompute the ustar checksum (chksum field treated as 8 spaces)
+printf '        ' | dd of=$tmp.tar bs=1 seek=660 count=8 conv=notrunc 2>/dev/null
+sum=`dd if=$tmp.tar bs=512 skip=1 count=1 2>/dev/null | \
+	od -An -tu1 -v | awk '{for(i=1;i<=NF;i++)s+=$i}END{printf "%06o",s}'`
+printf '%s\000 ' "$sum" | dd of=$tmp.tar bs=1 seek=660 count=8 conv=notrunc 2>/dev/null
+
+$MKFS_EROFS_PROG --tar $SCRATCH_DEV $tmp.tar >> $seqres.full 2>&1
+rc=$?
+[ $rc -ge 128 ] && _fail "mkfs.erofs crashed on hardlink-to-root (rc=$rc)"
+[ $rc -eq 0 ] && _fail "mkfs.erofs unexpectedly accepted hardlink-to-root"
+
+echo Silence is golden
+status=0
+exit 0
diff --git a/tests/erofs/031.out b/tests/erofs/031.out
new file mode 100644
index 0000000..b3d0bb0
--- /dev/null
+++ b/tests/erofs/031.out
@@ -0,0 +1,2 @@
+QA output created by 031
+Silence is golden
-- 
2.43.0