* Forwarded: [PATCH] hfsplus: fix ignored error return in hfsplus_delete_cat
2026-04-13 21:50 [syzbot] [hfs?] general protection fault in hfsplus_cat_write_inode syzbot
@ 2026-04-13 23:02 ` syzbot
2026-04-14 23:36 ` Forwarded: [PATCH] hfsplus: fix null-ptr-deref in hfsplus_cat_write_inode syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-04-13 23:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] hfsplus: fix ignored error return in hfsplus_delete_cat
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
hfsplus_delete_cat() calls hfsplus_delete_all_attrs() to remove all
extended attributes associated with a catalog entry, but silently
discards its return value. When the xattr deletion fails due to
filesystem corruption (as in a crafted image reported by syzbot),
hfsplus_delete_cat() returns 0 (success) to hfsplus_unlink().
hfsplus_unlink() then proceeds to call hfsplus_cat_write_inode() on
the inode in a corrupt, half-deleted state. Inside that function, if
HFSPLUS_IS_RSRC() is true but rsrc_inode was never properly set,
main_inode is assigned NULL. The subsequent dereference of
main_inode->i_nlink triggers a general protection fault, caught by
KASAN as a null-ptr-deref at offset 0x28.
Fix this by capturing the return value of hfsplus_delete_all_attrs()
and propagating genuine errors back to the caller. -ENOENT is
excluded since it signals normal loop termination (no more xattrs
left to delete) and is not an error condition.
Reported-by: syzbot+c0ba772a362e70937dfb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0ba772a362e70937dfb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/hfsplus/catalog.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 02c1eee4a4b8..adbaeabc06ab 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -421,8 +421,14 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
if (type == HFSPLUS_FILE || type == HFSPLUS_FOLDER) {
- if (HFSPLUS_SB(sb)->attr_tree)
- hfsplus_delete_all_attrs(dir, cnid);
+ if (HFSPLUS_SB(sb)->attr_tree) {
+ int attr_err = hfsplus_delete_all_attrs(dir, cnid);
+ if (attr_err && attr_err != -ENOENT) {
+ pr_err("hfsplus: failed to delete xattrs for cnid %u: %d\n",
+ cnid, attr_err);
+ err = attr_err;
+ }
+ }
}
out:
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] hfsplus: fix null-ptr-deref in hfsplus_cat_write_inode
2026-04-13 21:50 [syzbot] [hfs?] general protection fault in hfsplus_cat_write_inode syzbot
2026-04-13 23:02 ` Forwarded: [PATCH] hfsplus: fix ignored error return in hfsplus_delete_cat syzbot
@ 2026-04-14 23:36 ` syzbot
2026-04-28 9:23 ` Forwarded: [PATCH v4] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw syzbot
2026-04-29 1:58 ` Forwarded: [PATCH] " syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-04-14 23:36 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] hfsplus: fix null-ptr-deref in hfsplus_cat_write_inode
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When a corrupt HFS+ image is mounted where the hidden directory is
absent, hfsplus_fill_super() handles -ENOENT from
hfsplus_get_hidden_dir_entry() silently and continues with
sbi->hidden_dir left as NULL.
hfsplus_link() and hfsplus_unlink() call
hfsplus_cat_write_inode(sbi->hidden_dir) unconditionally without
checking whether hidden_dir is NULL, triggering a general protection
fault caught by KASAN as a null-ptr-deref at offset 0x28.
Other call sites in dir.c already guard against this by checking
hidden_dir for NULL before use. Apply the same guard to the two
unprotected call sites in hfsplus_link() and hfsplus_unlink().
Reported-by: syzbot+c0ba772a362e70937dfb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0ba772a362e70937dfb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/hfsplus/dir.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index d559bf8625f8..a7feef53d8cb 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -362,9 +362,11 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
if (res)
goto out;
- res = hfsplus_cat_write_inode(sbi->hidden_dir);
- if (res)
- goto out;
+ if (sbi->hidden_dir) {
+ res = hfsplus_cat_write_inode(sbi->hidden_dir);
+ if (res)
+ goto out;
+ }
res = hfsplus_cat_write_inode(inode);
@@ -431,11 +433,10 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
out:
if (!res) {
res = hfsplus_cat_write_inode(dir);
- if (!res) {
+ if (!res && sbi->hidden_dir)
res = hfsplus_cat_write_inode(sbi->hidden_dir);
- if (!res)
- res = hfsplus_cat_write_inode(inode);
- }
+ if (!res)
+ res = hfsplus_cat_write_inode(inode);
}
mutex_unlock(&sbi->vh_mutex);
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH v4] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw
2026-04-13 21:50 [syzbot] [hfs?] general protection fault in hfsplus_cat_write_inode syzbot
2026-04-13 23:02 ` Forwarded: [PATCH] hfsplus: fix ignored error return in hfsplus_delete_cat syzbot
2026-04-14 23:36 ` Forwarded: [PATCH] hfsplus: fix null-ptr-deref in hfsplus_cat_write_inode syzbot
@ 2026-04-28 9:23 ` syzbot
2026-04-29 1:58 ` Forwarded: [PATCH] " syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-04-28 9:23 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v4] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
hfsplus_reconfigure() does not create the hidden directory when
remounting from read-only to read-write, leaving sbi->hidden_dir
as NULL. This causes a null-ptr-deref when any subsequent
link/unlink/rename operation dereferences it.
Extract hidden directory creation into a helper and call it from
hfsplus_reconfigure() when switching to read-write mode.
Reported-by: syzbot+c0ba772a362e70937dfb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0ba772a362e70937dfb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v4:
- Correct fix: extract hidden dir creation into helper and call
from hfsplus_reconfigure() on remount rw, as suggested by
Vyacheslav Dubeyko.
Changes in v3:
- Correct fix location: guard sbi->hidden_dir in hfsplus_link()
and hfsplus_unlink() in dir.c.
Changes in v2:
- Fixed commit message: hfsplus_delete_cat() has multiple callers,
not just hfsplus_unlink() as incorrectly stated in v1.
---
fs/hfsplus/super.c | 88 ++++++++++++++++++++++++++++------------------
1 file changed, 53 insertions(+), 35 deletions(-)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 7229a8ae89f9..8b5c39ce4d48 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -372,15 +372,59 @@ static int hfsplus_statfs(struct dentry *dentry, struct kstatfs *buf)
return 0;
}
+static int hfsplus_create_hidden_dir(struct super_block *sb)
+{
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
+ struct inode *root = d_inode(sb->s_root);
+ struct qstr str;
+ int err;
+
+ str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
+ str.name = HFSP_HIDDENDIR_NAME;
+
+ mutex_lock(&sbi->vh_mutex);
+ sbi->hidden_dir = hfsplus_new_inode(sb, root, S_IFDIR);
+ if (!sbi->hidden_dir) {
+ mutex_unlock(&sbi->vh_mutex);
+ return -ENOMEM;
+ }
+
+ err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
+ &str, sbi->hidden_dir);
+ if (err) {
+ mutex_unlock(&sbi->vh_mutex);
+ goto out_put_hidden_dir;
+ }
+
+ err = hfsplus_init_security(sbi->hidden_dir, root, &str);
+ if (err == -EOPNOTSUPP)
+ err = 0;
+ else if (err) {
+ hfsplus_delete_cat(sbi->hidden_dir->i_ino, root, &str);
+ mutex_unlock(&sbi->vh_mutex);
+ goto out_put_hidden_dir;
+ }
+
+ mutex_unlock(&sbi->vh_mutex);
+ hfsplus_mark_inode_dirty(sbi->hidden_dir,
+ HFSPLUS_I_CAT_DIRTY);
+ return 0;
+
+out_put_hidden_dir:
+ iput(sbi->hidden_dir);
+ sbi->hidden_dir = NULL;
+ return err;
+}
+
static int hfsplus_reconfigure(struct fs_context *fc)
{
struct super_block *sb = fc->root->d_sb;
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
sync_filesystem(sb);
if ((bool)(fc->sb_flags & SB_RDONLY) == sb_rdonly(sb))
return 0;
if (!(fc->sb_flags & SB_RDONLY)) {
- struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
struct hfsplus_vh *vhdr = sbi->s_vhdr;
if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
@@ -401,6 +445,12 @@ static int hfsplus_reconfigure(struct fs_context *fc)
fc->sb_flags |= SB_RDONLY;
}
}
+ /*
+ * Create hidden dir if remounting read-write and it does
+ * not exist - required for link/unlink/rename operations.
+ */
+ if (!sb_rdonly(sb) && !sbi->hidden_dir)
+ return hfsplus_create_hidden_dir(sb);
return 0;
}
@@ -595,38 +645,9 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
hfsplus_sync_fs(sb, 1);
if (!sbi->hidden_dir) {
- mutex_lock(&sbi->vh_mutex);
- sbi->hidden_dir = hfsplus_new_inode(sb, root, S_IFDIR);
- if (!sbi->hidden_dir) {
- mutex_unlock(&sbi->vh_mutex);
- err = -ENOMEM;
+ err = hfsplus_create_hidden_dir(sb);
+ if (err)
goto out_put_root;
- }
- err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
- &str, sbi->hidden_dir);
- if (err) {
- mutex_unlock(&sbi->vh_mutex);
- goto out_put_hidden_dir;
- }
-
- err = hfsplus_init_security(sbi->hidden_dir,
- root, &str);
- if (err == -EOPNOTSUPP)
- err = 0; /* Operation is not supported. */
- else if (err) {
- /*
- * Try to delete anyway without
- * error analysis.
- */
- hfsplus_delete_cat(sbi->hidden_dir->i_ino,
- root, &str);
- mutex_unlock(&sbi->vh_mutex);
- goto out_put_hidden_dir;
- }
-
- mutex_unlock(&sbi->vh_mutex);
- hfsplus_mark_inode_dirty(sbi->hidden_dir,
- HFSPLUS_I_CAT_DIRTY);
}
}
@@ -634,9 +655,6 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
sbi->nls = nls;
return 0;
-out_put_hidden_dir:
- cancel_delayed_work_sync(&sbi->sync_work);
- iput(sbi->hidden_dir);
out_put_root:
dput(sb->s_root);
sb->s_root = NULL;
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw
2026-04-13 21:50 [syzbot] [hfs?] general protection fault in hfsplus_cat_write_inode syzbot
` (2 preceding siblings ...)
2026-04-28 9:23 ` Forwarded: [PATCH v4] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw syzbot
@ 2026-04-29 1:58 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-04-29 1:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
hfsplus_reconfigure() does not create the hidden directory when
remounting from read-only to read-write, leaving sbi->hidden_dir
as NULL. This causes a null-ptr-deref when any subsequent
link/unlink/rename operation dereferences it.
Extract hidden directory creation into a helper and call it from
hfsplus_reconfigure() when switching to read-write mode.
Reported-by: syzbot+c0ba772a362e70937dfb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0ba772a362e70937dfb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v4:
- Correct fix: extract hidden dir creation into helper and call
from hfsplus_reconfigure() on remount rw, as suggested by
Vyacheslav Dubeyko.
Changes in v3:
- Correct fix location: guard sbi->hidden_dir in hfsplus_link()
and hfsplus_unlink() in dir.c.
Changes in v2:
- Fixed commit message: hfsplus_delete_cat() has multiple callers,
not just hfsplus_unlink() as incorrectly stated in v1.
---
fs/hfsplus/super.c | 88 ++++++++++++++++++++++++++++------------------
1 file changed, 53 insertions(+), 35 deletions(-)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 7229a8ae89f9..8b5c39ce4d48 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -372,15 +372,59 @@ static int hfsplus_statfs(struct dentry *dentry, struct kstatfs *buf)
return 0;
}
+static int hfsplus_create_hidden_dir(struct super_block *sb)
+{
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
+ struct inode *root = d_inode(sb->s_root);
+ struct qstr str;
+ int err;
+
+ str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
+ str.name = HFSP_HIDDENDIR_NAME;
+
+ mutex_lock(&sbi->vh_mutex);
+ sbi->hidden_dir = hfsplus_new_inode(sb, root, S_IFDIR);
+ if (!sbi->hidden_dir) {
+ mutex_unlock(&sbi->vh_mutex);
+ return -ENOMEM;
+ }
+
+ err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
+ &str, sbi->hidden_dir);
+ if (err) {
+ mutex_unlock(&sbi->vh_mutex);
+ goto out_put_hidden_dir;
+ }
+
+ err = hfsplus_init_security(sbi->hidden_dir, root, &str);
+ if (err == -EOPNOTSUPP)
+ err = 0;
+ else if (err) {
+ hfsplus_delete_cat(sbi->hidden_dir->i_ino, root, &str);
+ mutex_unlock(&sbi->vh_mutex);
+ goto out_put_hidden_dir;
+ }
+
+ mutex_unlock(&sbi->vh_mutex);
+ hfsplus_mark_inode_dirty(sbi->hidden_dir,
+ HFSPLUS_I_CAT_DIRTY);
+ return 0;
+
+out_put_hidden_dir:
+ iput(sbi->hidden_dir);
+ sbi->hidden_dir = NULL;
+ return err;
+}
+
static int hfsplus_reconfigure(struct fs_context *fc)
{
struct super_block *sb = fc->root->d_sb;
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
sync_filesystem(sb);
if ((bool)(fc->sb_flags & SB_RDONLY) == sb_rdonly(sb))
return 0;
if (!(fc->sb_flags & SB_RDONLY)) {
- struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
struct hfsplus_vh *vhdr = sbi->s_vhdr;
if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
@@ -401,6 +445,12 @@ static int hfsplus_reconfigure(struct fs_context *fc)
fc->sb_flags |= SB_RDONLY;
}
}
+ /*
+ * Create hidden dir if remounting read-write and it does
+ * not exist - required for link/unlink/rename operations.
+ */
+ if (!sb_rdonly(sb) && !sbi->hidden_dir)
+ return hfsplus_create_hidden_dir(sb);
return 0;
}
@@ -595,38 +645,9 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
hfsplus_sync_fs(sb, 1);
if (!sbi->hidden_dir) {
- mutex_lock(&sbi->vh_mutex);
- sbi->hidden_dir = hfsplus_new_inode(sb, root, S_IFDIR);
- if (!sbi->hidden_dir) {
- mutex_unlock(&sbi->vh_mutex);
- err = -ENOMEM;
+ err = hfsplus_create_hidden_dir(sb);
+ if (err)
goto out_put_root;
- }
- err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
- &str, sbi->hidden_dir);
- if (err) {
- mutex_unlock(&sbi->vh_mutex);
- goto out_put_hidden_dir;
- }
-
- err = hfsplus_init_security(sbi->hidden_dir,
- root, &str);
- if (err == -EOPNOTSUPP)
- err = 0; /* Operation is not supported. */
- else if (err) {
- /*
- * Try to delete anyway without
- * error analysis.
- */
- hfsplus_delete_cat(sbi->hidden_dir->i_ino,
- root, &str);
- mutex_unlock(&sbi->vh_mutex);
- goto out_put_hidden_dir;
- }
-
- mutex_unlock(&sbi->vh_mutex);
- hfsplus_mark_inode_dirty(sbi->hidden_dir,
- HFSPLUS_I_CAT_DIRTY);
}
}
@@ -634,9 +655,6 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
sbi->nls = nls;
return 0;
-out_put_hidden_dir:
- cancel_delayed_work_sync(&sbi->sync_work);
- iput(sbi->hidden_dir);
out_put_root:
dput(sb->s_root);
sb->s_root = NULL;
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread