WARNING in hfs_bnode_create

WARNING in hfs_bnode_create

[syzbot]

Hello,

syzbot hit the following crash on upstream commit
f2d285669aae656dfeafa0bf25e86bbbc5d22329 (Tue Apr 3 17:45:39 2018 +0000)
Merge tag 'pm-4.17-rc1' of  
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
syzbot dashboard link:  
https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101

C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5003601122426880
syzkaller reproducer:  
https://syzkaller.appspot.com/x/repro.syz?id=5963421623255040
Raw console output:  
https://syzkaller.appspot.com/x/log.txt?id=5236399087288320
Kernel config: https://syzkaller.appspot.com/x/.config?id=686016073509112605
compiler: gcc (GCC) 7.1.1 20170620

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.

hfs: unable to locate alternate MDB
hfs: continuing without an alternate MDB
hfs: new node 0 already hashed?
WARNING: CPU: 0 PID: 4477 at fs/hfs/bnode.c:416  
hfs_bnode_create+0x30b/0x380 fs/hfs/bnode.c:415
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 4477 Comm: syzkaller579848 Not tainted 4.16.0+ #13
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x1a7/0x27d lib/dump_stack.c:53
  panic+0x1f8/0x42c kernel/panic.c:183
  __warn+0x1dc/0x200 kernel/panic.c:547
  report_bug+0x1f4/0x2b0 lib/bug.c:186
  fixup_bug.part.10+0x37/0x80 arch/x86/kernel/traps.c:178
  fixup_bug arch/x86/kernel/traps.c:247 [inline]
  do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
  invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:991
RIP: 0010:hfs_bnode_create+0x30b/0x380 fs/hfs/bnode.c:415
RSP: 0018:ffff8801ad477730 EFLAGS: 00010286
RAX: 000000000000001f RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000001f RSI: 1ffff10035a8ee9b RDI: ffffed0035a8eeda
RBP: ffff8801ad477770 R08: ffffed003b604f99 R09: ffffed003b604f99
R10: 0000000000000001 R11: ffffed003b604f98 R12: ffff8801d953ead0
R13: ffff8801d953ea00 R14: ffff8801d0811c00 R15: 0000000000000000
  hfs_bmap_alloc+0x804/0xee0 fs/hfs/btree.c:279
  hfs_bnode_split+0xc0/0xfb0 fs/hfs/brec.c:240
  hfs_brec_insert+0x366/0xb90 fs/hfs/brec.c:101
  hfs_cat_create+0xa06/0xd80 fs/hfs/catalog.c:123
  hfs_mkdir+0x6a/0xd0 fs/hfs/dir.c:237
  vfs_mkdir+0x390/0x600 fs/namei.c:3806
  do_mkdirat+0x224/0x2b0 fs/namei.c:3829
  SYSC_mkdir fs/namei.c:3845 [inline]
  SyS_mkdir+0x22/0x30 fs/namei.c:3843
  do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x440739
RSP: 002b:00007ffe4d841778 EFLAGS: 00000207 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440739
RDX: 0000000000401030 RSI: 0000000000000021 RDI: 0000000020000180
RBP: 0000000000000003 R08: 000000000000000a R09: 6f6f6c2f7665642f
R10: 0000000020011700 R11: 0000000000000207 R12: 0000000000000004
R13: 0000000000401fb0 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
    (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

Forwarded: [PATCH] hfs: return error when bnode already hashed in

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] hfs: return error when bnode already hashed in
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 hfs_bnode_create

hfs_bnode_create() checks if the requested node number is already
present in the B-tree hash table.  If it is, the function emits a
WARN_ON(1) and returns the existing node:

    if (node) {
        pr_crit("new node %u already hashed?\n", num);
        WARN_ON(1);
        return node;
    }

On crafted HFS images with inconsistent B-tree bitmap data, the
allocator can repeatedly request creation of node 0 which is
already hashed, triggering this WARNING reliably on every mkdir.

Replace the WARN_ON with an error return.  The node being already
hashed when creation is requested indicates filesystem corruption
-- returning ERR_PTR(-EIO) allows the caller to handle this
gracefully rather than generating a kernel stack trace.

Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfs/bnode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -517,8 +517,8 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	spin_unlock(&tree->hash_lock);
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
-		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EIO);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)
--
2.43.0

Forwarded: Re: [syzbot] WARNING in hfs_bnode_create

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] WARNING in hfs_bnode_create
Author: tristmd@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 89ec6a61f81d25f4bf256b4747be2dec6a36627a Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:20 +0000
Subject: [PATCH] hfs: return error when bnode already hashed in
 hfs_bnode_create()
hfs_bnode_create() uses WARN_ON(1) and returns the existing node
when a bnode is already hashed. On corrupted filesystems this
triggers repeated kernel WARNINGs. Replace with ERR_PTR(-EIO)
to properly signal the error to callers.
Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfs/bnode.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 13d58c5..255db8e 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -517,8 +517,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	spin_unlock(&tree->hash_lock);
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
-		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EIO);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)
-- 
2.47.3

Forwarded: Re: [syzbot] [hfs?] WARNING in hfs_bnode_create

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [hfs?] WARNING in hfs_bnode_create
Author: tristmd@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

>From 056301b328e16474cbd3485e8ba571d064ac31a0 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Sat, 18 Apr 2026 13:38:21 +0000
Subject: [PATCH] hfs: validate bitmap record offset in hfs_bmap_alloc

hfs_bmap_alloc() retrieves the bitmap record from the header node
using hfs_brec_lenoff() but does not validate the returned offset
and length before using them to compute page pointers.  On a crafted
HFS image with corrupted B-tree data, the offset can exceed the node
size, causing an out-of-bounds page access.

Additionally, when the bitmap has node 0 bit incorrectly unset,
hfs_bmap_alloc() calls hfs_bnode_create(tree, 0) for the already-
hashed header node, triggering a WARN_ON and returning the existing
node without incrementing its reference count.

Port the fixes already applied to HFS+ (commits d8a73cc46c84 and
738d5a51864e) to the HFS side:

1. Move is_bnode_offset_valid() and check_and_correct_requested_length()
   from bnode.c to btree.h so they can be used by btree.c.

2. Validate the record offset and length in hfs_bmap_alloc() before
   computing page pointers, preventing out-of-bounds access.

3. Return ERR_PTR(-EEXIST) from hfs_bnode_create() when the node is
   already hashed, properly signaling filesystem corruption to callers.

Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Tested-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfs/bnode.c | 44 +-------------------------------------------
 fs/hfs/btree.c |  6 ++++++
 fs/hfs/btree.h | 42 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 43 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 13d58c51fc46b..26c2e65ab5935 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -15,48 +15,6 @@
 
 #include "btree.h"
 
-static inline
-bool is_bnode_offset_valid(struct hfs_bnode *node, u32 off)
-{
-	bool is_valid = off < node->tree->node_size;
-
-	if (!is_valid) {
-		pr_err("requested invalid offset: "
-		       "NODE: id %u, type %#x, height %u, "
-		       "node_size %u, offset %u\n",
-		       node->this, node->type, node->height,
-		       node->tree->node_size, off);
-	}
-
-	return is_valid;
-}
-
-static inline
-u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
-{
-	unsigned int node_size;
-
-	if (!is_bnode_offset_valid(node, off))
-		return 0;
-
-	node_size = node->tree->node_size;
-
-	if ((off + len) > node_size) {
-		u32 new_len = node_size - off;
-
-		pr_err("requested length has been corrected: "
-		       "NODE: id %u, type %#x, height %u, "
-		       "node_size %u, offset %u, "
-		       "requested_len %u, corrected_len %u\n",
-		       node->this, node->type, node->height,
-		       node->tree->node_size, off, len, new_len);
-
-		return new_len;
-	}
-
-	return len;
-}
-
 void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)
 {
 	struct page *page;
@@ -518,7 +476,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
 		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EEXIST);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 2eb37a2f64e86..e8bc24c8baf1a 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -304,6 +304,12 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
 	len = hfs_brec_lenoff(node, 2, &off16);
 	off = off16;
 
+	if (!is_bnode_offset_valid(node, off)) {
+		hfs_bnode_put(node);
+		return ERR_PTR(-EIO);
+	}
+	len = check_and_correct_requested_length(node, off, len);
+
 	off += node->page_offset;
 	pagep = node->page + (off >> PAGE_SHIFT);
 	data = kmap_local_page(*pagep);
diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
index 99be858b24465..6032b14b1639d 100644
--- a/fs/hfs/btree.h
+++ b/fs/hfs/btree.h
@@ -85,6 +85,48 @@ struct hfs_find_data {
 };
 
 
+static inline
+bool is_bnode_offset_valid(struct hfs_bnode *node, u32 off)
+{
+	bool is_valid = off < node->tree->node_size;
+
+	if (!is_valid) {
+		pr_err("requested invalid offset: "
+		       "NODE: id %u, type %#x, height %u, "
+		       "node_size %u, offset %u\n",
+		       node->this, node->type, node->height,
+		       node->tree->node_size, off);
+	}
+
+	return is_valid;
+}
+
+static inline
+u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
+{
+	unsigned int node_size;
+
+	if (!is_bnode_offset_valid(node, off))
+		return 0;
+
+	node_size = node->tree->node_size;
+
+	if ((off + len) > node_size) {
+		u32 new_len = node_size - off;
+
+		pr_err("requested length has been corrected: "
+		       "NODE: id %u, type %#x, height %u, "
+		       "node_size %u, offset %u, "
+		       "requested_len %u, corrected_len %u\n",
+		       node->this, node->type, node->height,
+		       node->tree->node_size, off, len, new_len);
+
+		return new_len;
+	}
+
+	return len;
+}
+
 /* btree.c */
 extern struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id,
 					btree_keycmp keycmp);
-- 
2.47.3