Skip to content

Commit b226804

Browse files
LATENTBOUNCEdubeyko
LATENTBOUNCE
authored and
dubeyko
committed
hfs: Replace BUG_ON with error handling for CNID count checks
In a06ec28 next_id, folder_count, and file_count in the super block info were expanded to 64 bits, and BUG_ONs were added to detect overflow. This triggered an error reported by syzbot: if the MDB is corrupted, the BUG_ON is triggered. This patch replaces this mechanism with proper error handling and resolves the syzbot reported bug. Singed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=17cc9bb6d8d69b4139f0 Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20251220191006.2465256-1-jkoolstra@xs4all.nl Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
1 parent 413466f commit b226804

5 files changed

Lines changed: 66 additions & 14 deletions

File tree

‎fs/hfs/dir.c‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
196196
int res;
197197

198198
inode = hfs_new_inode(dir, &dentry->d_name, mode);
199-
if (!inode)
200-
return -ENOMEM;
199+
if (IS_ERR(inode))
200+
return PTR_ERR(inode);
201201

202202
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
203203
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
226226
int res;
227227

228228
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
229-
if (!inode)
230-
return ERR_PTR(-ENOMEM);
229+
if (IS_ERR(inode))
230+
return ERR_CAST(inode);
231231

232232
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
233233
if (res) {
@@ -254,11 +254,18 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
254254
*/
255255
static int hfs_remove(struct inode *dir, struct dentry *dentry)
256256
{
257+
struct super_block *sb = dir->i_sb;
257258
struct inode *inode = d_inode(dentry);
258259
int res;
259260

260261
if (S_ISDIR(inode->i_mode) && inode->i_size != 2)
261262
return -ENOTEMPTY;
263+
264+
if (unlikely(!is_hfs_cnid_counts_valid(sb))) {
265+
pr_err("cannot remove file/folder\n");
266+
return -ERANGE;
267+
}
268+
262269
res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
263270
if (res)
264271
return res;

‎fs/hfs/hfs_fs.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ extern void hfs_delete_inode(struct inode *inode);
199199
extern const struct xattr_handler * const hfs_xattr_handlers[];
200200

201201
/* mdb.c */
202+
extern bool is_hfs_cnid_counts_valid(struct super_block *sb);
202203
extern int hfs_mdb_get(struct super_block *sb);
203204
extern void hfs_mdb_commit(struct super_block *sb);
204205
extern void hfs_mdb_close(struct super_block *sb);

‎fs/hfs/inode.c‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,16 +187,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
187187
s64 next_id;
188188
s64 file_count;
189189
s64 folder_count;
190+
int err = -ENOMEM;
190191

191192
if (!inode)
192-
return NULL;
193+
goto out_err;
194+
195+
err = -ERANGE;
193196

194197
mutex_init(&HFS_I(inode)->extents_lock);
195198
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
196199
spin_lock_init(&HFS_I(inode)->open_dir_lock);
197200
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
198201
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
199-
BUG_ON(next_id > U32_MAX);
202+
if (next_id > U32_MAX) {
203+
atomic64_dec(&HFS_SB(sb)->next_id);
204+
pr_err("cannot create new inode: next CNID exceeds limit\n");
205+
goto out_discard;
206+
}
200207
inode->i_ino = (u32)next_id;
201208
inode->i_mode = mode;
202209
inode->i_uid = current_fsuid();
@@ -210,7 +217,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
210217
if (S_ISDIR(mode)) {
211218
inode->i_size = 2;
212219
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
213-
BUG_ON(folder_count > U32_MAX);
220+
if (folder_count> U32_MAX) {
221+
atomic64_dec(&HFS_SB(sb)->folder_count);
222+
pr_err("cannot create new inode: folder count exceeds limit\n");
223+
goto out_discard;
224+
}
214225
if (dir->i_ino == HFS_ROOT_CNID)
215226
HFS_SB(sb)->root_dirs++;
216227
inode->i_op = &hfs_dir_inode_operations;
@@ -220,7 +231,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
220231
} else if (S_ISREG(mode)) {
221232
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
222233
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
223-
BUG_ON(file_count > U32_MAX);
234+
if (file_count > U32_MAX) {
235+
atomic64_dec(&HFS_SB(sb)->file_count);
236+
pr_err("cannot create new inode: file count exceeds limit\n");
237+
goto out_discard;
238+
}
224239
if (dir->i_ino == HFS_ROOT_CNID)
225240
HFS_SB(sb)->root_files++;
226241
inode->i_op = &hfs_file_inode_operations;
@@ -244,6 +259,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
244259
hfs_mark_mdb_dirty(sb);
245260

246261
return inode;
262+
263+
out_discard:
264+
iput(inode);
265+
out_err:
266+
return ERR_PTR(err);
247267
}
248268

249269
void hfs_delete_inode(struct inode *inode)
@@ -252,7 +272,6 @@ void hfs_delete_inode(struct inode *inode)
252272

253273
hfs_dbg("ino %lu\n", inode->i_ino);
254274
if (S_ISDIR(inode->i_mode)) {
255-
BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
256275
atomic64_dec(&HFS_SB(sb)->folder_count);
257276
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
258277
HFS_SB(sb)->root_dirs--;
@@ -261,7 +280,6 @@ void hfs_delete_inode(struct inode *inode)
261280
return;
262281
}
263282

264-
BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
265283
atomic64_dec(&HFS_SB(sb)->file_count);
266284
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
267285
HFS_SB(sb)->root_files--;

‎fs/hfs/mdb.c‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,27 @@ static int hfs_get_last_session(struct super_block *sb,
6464
return 0;
6565
}
6666

67+
bool is_hfs_cnid_counts_valid(struct super_block *sb)
68+
{
69+
struct hfs_sb_info *sbi = HFS_SB(sb);
70+
bool corrupted = false;
71+
72+
if (unlikely(atomic64_read(&sbi->next_id) > U32_MAX)) {
73+
pr_warn("next CNID exceeds limit\n");
74+
corrupted = true;
75+
}
76+
if (unlikely(atomic64_read(&sbi->file_count) > U32_MAX)) {
77+
pr_warn("file count exceeds limit\n");
78+
corrupted = true;
79+
}
80+
if (unlikely(atomic64_read(&sbi->folder_count) > U32_MAX)) {
81+
pr_warn("folder count exceeds limit\n");
82+
corrupted = true;
83+
}
84+
85+
return !corrupted;
86+
}
87+
6788
/*
6889
* hfs_mdb_get()
6990
*
@@ -159,6 +180,11 @@ int hfs_mdb_get(struct super_block *sb)
159180
atomic64_set(&HFS_SB(sb)->file_count, be32_to_cpu(mdb->drFilCnt));
160181
atomic64_set(&HFS_SB(sb)->folder_count, be32_to_cpu(mdb->drDirCnt));
161182

183+
if (!is_hfs_cnid_counts_valid(sb)) {
184+
pr_warn("filesystem possibly corrupted, running fsck.hfs is recommended. Mounting read-only.\n");
185+
sb->s_flags |= SB_RDONLY;
186+
}
187+
162188
/* TRY to get the alternate (backup) MDB. */
163189
sect = part_start + part_size - 2;
164190
bh = sb_bread512(sb, sect, mdb2);
@@ -212,7 +238,7 @@ int hfs_mdb_get(struct super_block *sb)
212238

213239
attrib = mdb->drAtrb;
214240
if (!(attrib & cpu_to_be16(HFS_SB_ATTRIB_UNMNT))) {
215-
pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only.\n");
241+
pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only.\n");
216242
sb->s_flags |= SB_RDONLY;
217243
}
218244
if ((attrib & cpu_to_be16(HFS_SB_ATTRIB_SLOCK))) {
@@ -270,15 +296,12 @@ void hfs_mdb_commit(struct super_block *sb)
270296
/* These parameters may have been modified, so write them back */
271297
mdb->drLsMod = hfs_mtime();
272298
mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
273-
BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
274299
mdb->drNxtCNID =
275300
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
276301
mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
277302
mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
278-
BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
279303
mdb->drFilCnt =
280304
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
281-
BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
282305
mdb->drDirCnt =
283306
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
284307

‎fs/hfs/super.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ MODULE_LICENSE("GPL");
3434

3535
static int hfs_sync_fs(struct super_block *sb, int wait)
3636
{
37+
is_hfs_cnid_counts_valid(sb);
3738
hfs_mdb_commit(sb);
3839
return 0;
3940
}
@@ -65,6 +66,8 @@ static void flush_mdb(struct work_struct *work)
6566
sbi->work_queued = 0;
6667
spin_unlock(&sbi->work_lock);
6768

69+
is_hfs_cnid_counts_valid(sb);
70+
6871
hfs_mdb_commit(sb);
6972
}
7073

0 commit comments

Comments
 (0)