* [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move
@ 2024-01-22 9:48 syzbot
2025-07-27 18:17 ` syztest Arnaud Lecomte
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2024-01-22 9:48 UTC (permalink / raw)
To: linux-fsdevel, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 125514880ddd Merge tag 'sh-for-v6.8-tag1' of git://git.ker..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15edd643e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7a6ff9d9d5d2dc4a
dashboard link: https://syzkaller.appspot.com/bug?extid=6df204b70bf3261691c5
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=169c2d57e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11109193e80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/86a8a3ee9ef1/disk-12551488.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b73f0ed65615/vmlinux-12551488.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7aa088345217/bzImage-12551488.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/3a894fc3d764/mount_0.gz
Bisection is inconclusive: the issue happens on the oldest tested release.
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12fdd643e80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=11fdd643e80000
console output: https://syzkaller.appspot.com/x/log.txt?x=16fdd643e80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 1024
==================================================================
BUG: KASAN: out-of-bounds in hfsplus_bnode_move+0x5f3/0x910 fs/hfsplus/bnode.c:228
Read of size 18446744073709551602 at addr 000508800000104e by task syz-executor353/5048
CPU: 0 PID: 5048 Comm: syz-executor353 Not tainted 6.7.0-syzkaller-12829-g125514880ddd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_report+0xe6/0x540 mm/kasan/report.c:491
kasan_report+0x142/0x170 mm/kasan/report.c:601
kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189
__asan_memmove+0x29/0x70 mm/kasan/shadow.c:94
hfsplus_bnode_move+0x5f3/0x910 fs/hfsplus/bnode.c:228
hfsplus_brec_insert+0x61c/0xdd0 fs/hfsplus/brec.c:128
hfsplus_create_attr+0x49e/0x630 fs/hfsplus/attributes.c:252
__hfsplus_setxattr+0x6fe/0x22d0 fs/hfsplus/xattr.c:354
hfsplus_initxattrs+0x158/0x220 fs/hfsplus/xattr_security.c:59
security_inode_init_security+0x2a7/0x470 security/security.c:1752
hfsplus_fill_super+0x14d3/0x1c90 fs/hfsplus/super.c:567
mount_bdev+0x206/0x2d0 fs/super.c:1663
legacy_get_tree+0xef/0x190 fs/fs_context.c:662
vfs_get_tree+0x8c/0x2a0 fs/super.c:1784
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fd7936b4d3a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff572a70a8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff572a70c0 RCX: 00007fd7936b4d3a
RDX: 0000000020000040 RSI: 0000000020000240 RDI: 00007fff572a70c0
RBP: 0000000000000004 R08: 00007fff572a7100 R09: 00000000000006c8
R10: 0000000000800000 R11: 0000000000000286 R12: 0000000000800000
R13: 00007fff572a7100 R14: 0000000000000003 R15: 0000000000080000
</TASK>
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread* syztest
2024-01-22 9:48 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
@ 2025-07-27 18:17 ` Arnaud Lecomte
2025-07-27 18:52 ` [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
2026-04-30 22:41 ` Forwarded: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move syzbot
2026-05-05 11:12 ` Forwarded: Re: [syzbot] KASAN: slab-out-of-bounds in hfs_bnode_read syzbot
2 siblings, 1 reply; 6+ messages in thread
From: Arnaud Lecomte @ 2025-07-27 18:17 UTC (permalink / raw)
To: syzbot+6df204b70bf3261691c5; +Cc: linux-fsdevel, linux-kernel, syzkaller-bugs
#syz test
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -124,6 +124,12 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
data_rec_off += 2;
} while (data_rec_off < idx_rec_off);
+ if (end_off < data_off) {
+ hfs_dbg(BNODE_MOD, "corrupted node: end_off %u < data_off %u\n", end_off, data_off);
+ if (new_node)
+ hfs_bnode_put(new_node);
+ return -EIO;
+ }
/* move data away */
hfs_bnode_move(node, data_off + size, data_off,
end_off - data_off);
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move
2024-01-22 9:48 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
2025-07-27 18:17 ` syztest Arnaud Lecomte
@ 2026-04-30 22:41 ` syzbot
2026-05-05 11:12 ` Forwarded: Re: [syzbot] KASAN: slab-out-of-bounds in hfs_bnode_read syzbot
2 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-04-30 22:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move
Author: tristmd@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 481707e6b354ae2f36603d68c63364b56d6ee6b6 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Thu, 30 Apr 2026 22:38:32 +0000
Subject: [PATCH 1/3] hfs/hfsplus: fix u32 overflow in
check_and_correct_requested_length
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.
Fix this by comparing len against (node_size - off) instead. Since
is_bnode_offset_valid() already guarantees off < node_size before this
point, the subtraction cannot underflow.
Reported-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
Reported-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/hfs/bnode.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 13d58c51fc46b..c00645a4a5733 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -41,7 +41,7 @@ u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if (len > node_size - off) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 3545b8dbf11c5..10b2dda3f8044 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -600,7 +600,7 @@ u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if (len > node_size - off) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Forwarded: Re: [syzbot] KASAN: slab-out-of-bounds in hfs_bnode_read
2024-01-22 9:48 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
2025-07-27 18:17 ` syztest Arnaud Lecomte
2026-04-30 22:41 ` Forwarded: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move syzbot
@ 2026-05-05 11:12 ` syzbot
2 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-05-05 11:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] KASAN: slab-out-of-bounds in hfs_bnode_read
Author: tristmd@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From f6b9bdbe52aac7659475c0474819f7b6c837761f Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Tue, 5 May 2026 11:05:24 +0000
Subject: [PATCH v2 1/2] hfs/hfsplus: fix u32 overflow in
check_and_correct_requested_length
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.
Fix this by widening the addition to u64 before comparing against
node_size. This prevents the u32 wrap while keeping the logic
straightforward.
Reported-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6df204b70bf3261691c5
Tested-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
Reported-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e76bf3d19b85350571ac
Tested-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/hfs/bnode.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 13d58c51fc46b..9571f33b91085 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -41,7 +41,7 @@ u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if ((u64)off + len > node_size) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 3545b8dbf11c5..0e4268de9e60e 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -600,7 +600,7 @@ u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if ((u64)off + len > node_size) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move
@ 2025-07-23 17:18 syzbot
2025-07-24 1:52 ` Forwarded: " syzbot
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2025-07-23 17:18 UTC (permalink / raw)
To: frank.li, glaubitz, linux-fsdevel, linux-kernel, slava,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 89be9a83ccf1 Linux 6.16-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ac1b82580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8adfe52da0de2761
dashboard link: https://syzkaller.appspot.com/bug?extid=41ba9c82bce8d7101765
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1771ef22580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f764f0580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-89be9a83.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a3f5f507f252/vmlinux-89be9a83.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a8f9b92c57a6/bzImage-89be9a83.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f02d92e4771f/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+41ba9c82bce8d7101765@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 64
==================================================================
BUG: KASAN: out-of-bounds in hfs_bnode_move+0xea/0x130 fs/hfs/bnode.c:143
Read of size 18446744073709486080 at addr ffff888000994400 by task syz.0.16/5547
CPU: 0 UID: 0 PID: 5547 Comm: syz.0.16 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
__asan_memmove+0x29/0x70 mm/kasan/shadow.c:94
hfs_bnode_move+0xea/0x130 fs/hfs/bnode.c:143
hfs_brec_remove+0x467/0x550 fs/hfs/brec.c:222
hfs_cat_move+0x6fb/0x960 fs/hfs/catalog.c:364
hfs_rename+0x1dc/0x2d0 fs/hfs/dir.c:299
vfs_rename+0xb99/0xec0 fs/namei.c:5137
do_renameat2+0x878/0xc50 fs/namei.c:5286
__do_sys_rename fs/namei.c:5333 [inline]
__se_sys_rename fs/namei.c:5331 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:5331
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f11db18e9a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd56ec9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f11db3b5fa0 RCX: 00007f11db18e9a9
RDX: 0000000000000000 RSI: 0000200000000780 RDI: 00002000000003c0
RBP: 00007f11db210d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f11db3b5fa0 R14: 00007f11db3b5fa0 R15: 0000000000000002
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x35 pfn:0x994
memcg:ffff888030a98000
anon flags: 0x7ff00000020908(uptodate|active|owner_2|swapbacked|node=0|zone=0|lastcpupid=0x7ff)
raw: 007ff00000020908 0000000000000000 dead000000000122 ffff888059a96cc1
raw: 0000000000000035 0000000000000000 00000001ffffffff ffff888030a98000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5548, tgid 5548 (dhcpcd-run-hook), ts 123108746961, free_ts 121368908469
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1704
prep_new_page mm/page_alloc.c:1712 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3669
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4959
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
folio_alloc_mpol_noprof mm/mempolicy.c:2438 [inline]
vma_alloc_folio_noprof+0xe4/0x200 mm/mempolicy.c:2473
folio_prealloc+0x30/0x180 mm/memory.c:-1
wp_page_copy mm/memory.c:3569 [inline]
do_wp_page+0x1231/0x5800 mm/memory.c:4030
handle_pte_fault mm/memory.c:6085 [inline]
__handle_mm_fault+0x1144/0x5620 mm/memory.c:6212
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6381
do_user_addr_fault+0xa81/0x1390 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
page last free pid 5509 tgid 5509 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1248 [inline]
free_unref_folios+0xc66/0x14d0 mm/page_alloc.c:2763
folios_put_refs+0x559/0x640 mm/swap.c:992
free_pages_and_swap_cache+0x4be/0x520 mm/swap_state.c:267
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0x3a0/0x680 mm/mmu_gather.c:404
tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:497
exit_mmap+0x44c/0xb50 mm/mmap.c:1297
__mmput+0x118/0x420 kernel/fork.c:1121
exit_mm+0x1da/0x2c0 kernel/exit.c:581
do_exit+0x648/0x22e0 kernel/exit.c:952
do_group_exit+0x21c/0x2d0 kernel/exit.c:1105
__do_sys_exit_group kernel/exit.c:1116 [inline]
__se_sys_exit_group kernel/exit.c:1114 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1114
x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888000994300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888000994380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888000994400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888000994480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888000994500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move
2025-07-23 17:18 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move syzbot
@ 2025-07-24 1:52 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2025-07-24 1:52 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move
Author: lizhi.xu@windriver.com
#syz test
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index cb823a8a6ba9..58c5cc7adf70 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -134,7 +134,7 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
void *ptr;
hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len);
- if (!len)
+ if (len <= 0)
return;
src += node->page_offset;
dst += node->page_offset;
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-05-05 11:12 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-22 9:48 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
2025-07-27 18:17 ` syztest Arnaud Lecomte
2025-07-27 18:52 ` [syzbot] [hfs?] KASAN: out-of-bounds Read in hfsplus_bnode_move syzbot
2026-04-30 22:41 ` Forwarded: Re: [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move syzbot
2026-05-05 11:12 ` Forwarded: Re: [syzbot] KASAN: slab-out-of-bounds in hfs_bnode_read syzbot
-- strict thread matches above, loose matches on Subject: below --
2025-07-23 17:18 [syzbot] [hfs?] KASAN: out-of-bounds Read in hfs_bnode_move syzbot
2025-07-24 1:52 ` Forwarded: " syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox