From dce0e0248205bb3dc5b4c6793cd2ecb453152259 Mon Sep 17 00:00:00 2001 From: Bruno Produit Date: Mon, 21 Sep 2026 17:37:29 +0200 Subject: [PATCH] hfs/hfsplus: serialize B-tree close against folio release B-tree nodes with a zero reference count remain in the node hash until folio reclaim or tree teardown frees them. The folio release callbacks remove nodes while holding hash_lock, but hfs_btree_close() walks and frees the same hash without that lock. Reclaim can therefore unhash and free a node after close has loaded its pointer, causing a use-after-free or double-free. The following syzkaller crashes seem to be the same UAF in {hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and follow the same pattern, but do not contain a reproducer to confirm. Detach each node with hfs_bnode_unhash() while holding hash_lock before inspecting and freeing it. Drop the lock before hfs_bnode_free() so a large tree is not freed while holding a spinlock. Apply the same fix to the matching HFS+ implementation. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5 Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381 Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607 Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d Assisted-by: Codex:gpt-5.6-sol Reported-by: Kyle Zeng Signed-off-by: Kyle Zeng Signed-off-by: Bruno Produit Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260921153729.600313-1-bruno.produit@trailofbits.com Signed-off-by: Viacheslav Dubeyko --- fs/hfs/btree.c | 7 +++++-- fs/hfsplus/btree.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c index 41b4e8fc9463..4f0ddc76e8c5 100644 --- a/fs/hfs/btree.c +++ b/fs/hfs/btree.c @@ -310,15 +310,18 @@ void hfs_btree_close(struct hfs_btree *tree) return; for (i = 0; i < NODE_HASH_SIZE; i++) { + spin_lock(&tree->hash_lock); while ((node = tree->node_hash[i])) { - tree->node_hash[i] = node->next_hash; + hfs_bnode_unhash(node); + spin_unlock(&tree->hash_lock); if (atomic_read(&node->refcnt)) pr_err("node %d:%d still has %d user(s)!\n", node->tree->cnid, node->this, atomic_read(&node->refcnt)); hfs_bnode_free(node); - tree->node_hash_cnt--; + spin_lock(&tree->hash_lock); } + spin_unlock(&tree->hash_lock); } iput(tree->inode); kfree(tree); diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c index 2ea8cd5658e1..bd4dbdbc8f98 100644 --- a/fs/hfsplus/btree.c +++ b/fs/hfsplus/btree.c @@ -417,16 +417,19 @@ void hfs_btree_close(struct hfs_btree *tree) return; for (i = 0; i < NODE_HASH_SIZE; i++) { + spin_lock(&tree->hash_lock); while ((node = tree->node_hash[i])) { - tree->node_hash[i] = node->next_hash; + hfs_bnode_unhash(node); + spin_unlock(&tree->hash_lock); if (atomic_read(&node->refcnt)) pr_crit("node %d:%d " "still has %d user(s)!\n", node->tree->cnid, node->this, atomic_read(&node->refcnt)); hfs_bnode_free(node); - tree->node_hash_cnt--; + spin_lock(&tree->hash_lock); } + spin_unlock(&tree->hash_lock); } iput(tree->inode); kfree(tree);