github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
00aedd67d7
linux/fs
History
Jiaming Zhang 00aedd67d7 hfsplus: validate B-tree record offset table 
A crafted HFS+ image can contain a corrupted B-tree node. The node
descriptor may contain a record count that does not fit in the node, and
record offsets may be unordered, unaligned, outside the node, or point into
the offset table itself.

Several B-tree helpers consume these on-disk fields before validating them:
hfs_bnode_dump() can walk past the offset table when num_recs is corrupted,
hfs_brec_lenoff() can produce an underflowed length or a record range that
overlaps the offset table. This can make the unlink/writeback path
repeatedly call hfs_bnode_read_u16() with invalid offsets while holding the
HFS+ B-tree lock, producing a flood of "requested invalid offset" messages.
Other writeback workers then block on tree->tree_lock and the system
reports tasks hung in hfsplus_write_inode().

Validate num_recs against the node size before walking the record offset
table. Reject record ranges that are unordered, unaligned, outside the
node, or overlapping the offset table. Reject invalid record indexes before
reading their offset entries, and avoid decrementing an already-zero
leaf_count.

Closes: https://lore.kernel.org/lkml/CANypQFb_2TqKGrztAXj5m0_v+QChxXDnQVeifzV8J25Vuju10Q@mail.gmail.com/
Assisted-by: Codex:gpt-5.5-xhigh
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260806073358.1184938-1-r772577952@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-08-11 16:22:26 -07:00
..
9p Asides of the avalanche of LLM-driven fixes, there are a couple of 2026-06-21 10:26:31 -07:00
adfs ARM development for 7.1-rc1 2026-04-25 07:44:26 -07:00
affs affs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
afs afs: Fix uncancelled rxrpc OOB message handler 2026-06-25 10:07:18 -07:00
autofs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
befs befs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
bfs bfs: replace get_zeroed_page() with kzalloc() 2026-05-28 13:58:14 +02:00
btrfs mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
cachefiles cachefiles: Fix error return when vfs_mkdir() fails 2026-05-15 15:32:43 +02:00
ceph This adds support for manual client session reset in CephFS, allowing 2026-06-26 16:15:53 -07:00
coda coda cleanups and fixes 2026-04-21 14:03:10 -07:00
configfs configfs work 2026-06-15 04:28:20 +05:30
cramfs cramfs: drop obsolete Future Development notes and update tools URL 2026-05-03 09:12:23 -06:00
crypto fscrypt: Replace mk_users keyring with simple list 2026-06-22 12:12:11 -07:00
debugfs debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() 2026-04-02 16:15:23 +02:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm dlm: init per node debugfs before add to node hash 2026-05-08 08:38:03 -05:00
ecryptfs The set of eCryptfs changes for the 7.2-rc1 merge window consists of: 2026-06-26 08:24:06 -07:00
efivarfs efivarfs: use QSTR() in efivarfs_alloc_dentry 2026-04-28 12:30:59 +02:00
efs fs: efs: remove unneeded debug prints 2026-06-11 11:42:21 -07:00
erofs erofs: handle 48-bit blocks_hi for compressed inodes 2026-06-22 18:50:36 +08:00
exfat exfat: bound uniname advance in exfat_find_dir_entry() 2026-06-15 20:01:04 +09:00
exportfs find_acceptable_alias(): skip NORCU aliases with zero refcount 2026-06-05 00:34:55 -04:00
ext2 ext2: fix ignored return value of generic_write_sync() 2026-06-02 10:56:16 +02:00
ext4 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
f2fs f2fs: fix to round down start offset of fallocate for pin file 2026-06-22 19:55:27 +00:00
fat mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
freevxfs treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fuse fuse update for 7.2 2026-06-18 08:50:52 -07:00
gfs2 gfs2 fixes 2026-06-26 15:13:06 -07:00
hfs hfs: rework MDB locking scheme 2026-07-27 20:25:30 -07:00
hfsplus hfsplus: validate B-tree record offset table 2026-08-11 16:22:26 -07:00
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
hugetlbfs mm: use mapping_mapped to simplify the code 2026-06-21 11:37:38 -07:00
iomap vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
isofs \n 2026-06-16 11:58:52 +05:30
jbd2 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
jffs2 treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
jfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
kernfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
lockd lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() 2026-06-09 16:32:59 -04:00
minix minix: release the sb buffer_head when setting the v3 block size fails 2026-05-22 12:20:49 +02:00
netfs netfs, afs: Fix write skipping in dir/link writepages 2026-05-12 14:42:32 +02:00
nfs NFS Client Updates for Linux 7.2 2026-06-23 18:36:41 -07:00
nfs_common NFSD: Remove NFSERR_EAGAIN 2026-01-02 13:43:41 -05:00
nfsd NFSD 7.2 Release Notes 2026-06-18 09:14:15 -07:00
nilfs2 nilfs2 updates for v7.2 2026-06-16 12:14:20 +05:30
nls fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() 2025-12-01 11:58:06 +02:00
notify \n 2026-06-16 11:56:43 +05:30
ntfs Description for this pull request: 2026-06-19 13:23:59 -07:00
ntfs3 Changes for 7.2-rc1 2026-06-24 10:05:53 -07:00
ocfs2 mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
omfs omfs: handle set_blocksize failures 2026-05-21 13:39:36 +02:00
openpromfs
orangefs fs: Fix return in jfs_mkdir and orangefs_mkdir 2026-05-11 14:19:01 +02:00
overlayfs ovl: keep err zero after successful ovl_cache_get() 2026-05-18 14:56:15 +02:00
proc mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
pstore mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
qnx4 qnx4: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
qnx6 fs/qnx6: fix pointer arithmetic in directory iteration 2026-05-28 14:16:33 +02:00
quota quota: allocate dquot_hash with kmalloc() 2026-05-27 15:12:22 +02:00
ramfs folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
resctrl fs/resctrl: Continue counter allocation after failure 2026-05-08 12:07:43 +02:00
romfs mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
smb 50 ksmbd server fixes 2026-06-26 08:17:42 -07:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs tracefs: use d_splice_alias() in ->lookup() instances 2026-06-05 01:12:15 -04:00
ubifs fs: add icount_read_once() and stop open-coding ->i_count loads 2026-05-11 23:12:28 +02:00
udf \n 2026-06-16 11:58:52 +05:30
ufs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf vboxsf: Implement fileattr_get for case sensitivity 2026-05-11 16:50:29 +02:00
verity bpf-next-7.2 2026-06-17 09:18:14 +01:00
xfs xfs: new code for Linux 7.2 2026-06-16 11:50:40 +05:30
zonefs zonefs: handle integer overflow in zonefs_fname_to_fno 2026-05-12 07:53:20 +09:00
aio.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
anon_inodes.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
attr.c filelock: add support for ignoring deleg breaks for dir change events 2026-05-15 19:24:32 +02:00
backing-file.c backing-file: fix backing_file_open() kerneldoc parameter 2026-06-10 09:49:25 +02:00
bad_inode.c fs: refactor ->update_time handling 2026-01-12 14:01:32 +01:00
binfmt_elf_fdpic.c vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
binfmt_elf.c mm: unexport vm_brk_flags() and eliminate vm_flags parameter 2026-04-05 13:53:39 -07:00
binfmt_flat.c
binfmt_misc.c binfmt_misc: replace __get_free_page() with kmalloc() 2026-05-28 13:58:14 +02:00
binfmt_script.c
bpf_fs_kfuncs.c bpf-next-7.2 2026-06-17 09:18:14 +01:00
buffer.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
coredump.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
d_path.c dcache: permit dynamic_dname()s up to NAME_MAX 2026-04-07 12:32:22 +02:00
dax.c dax changes for 7.1 2026-04-21 14:12:01 -07:00
dcache.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
direct-io.c direct-io: remove IOCB_NOWAIT support 2026-05-26 11:01:55 -06:00
drop_caches.c
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list 2026-06-04 13:53:50 +02:00
exec.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
fcntl.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
fhandle.c fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() 2026-06-04 09:39:50 +02:00
file_attr.c fs: Add case sensitivity flags to file_kattr 2026-05-11 16:50:27 +02:00
file_table.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
file.c fs: retire stale comment in fget_task_next() 2026-05-28 14:27:00 +02:00
filesystems.c fs: fix ups and tidy ups to /proc/filesystems caching 2026-06-12 14:26:27 +02:00
fs_context.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
fs_dirent.c
fs_parser.c fs: remove fsparam_path / fs_param_is_path 2026-02-19 14:34:26 +01:00
fs_pin.c
fs_struct.c fs: add <linux/init_task.h> for 'init_fs' 2026-01-14 16:50:37 +01:00
fs-writeback.c mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking 2026-06-04 10:16:51 +02:00
fserror.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
internal.h fuse: invalidate page cache after DIO and async DIO writes 2026-06-15 14:06:20 +02:00
ioctl.c
Kconfig treewide: fix indentation and whitespace in Kconfig files 2026-05-28 21:24:42 -07:00
Kconfig.binfmt
kernel_read_file.c
libfs.c This series converts a bunch of unidiomatic uses of d_add() 2026-06-15 04:21:00 +05:30
locks.c filelock: add an inode_lease_ignore_mask helper 2026-05-15 19:24:32 +02:00
Makefile userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c 2026-06-04 14:45:03 -07:00
mbcache.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
mnt_idmapping.c fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap 2026-05-11 14:19:01 +02:00
mount.h vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
mpage.c mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
namei.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
namespace.c vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
nsfs.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
nullfs.c fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
open.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
pidfs.c \n 2026-06-16 11:56:43 +05:30
pipe.c fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write 2026-05-28 14:33:24 +02:00
pnode.c
pnode.h
posix_acl.c filelock: add support for ignoring deleg breaks for dir change events 2026-05-15 19:24:32 +02:00
proc_namespace.c
read_write.c fs/read_write: Do not export __kernel_write() to the entire world 2026-06-05 14:46:20 +02:00
readdir.c fs: Replace user_access_{begin/end} by scoped user access 2026-03-24 14:44:02 +01:00
remap_range.c
select.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c
stat.c statx: switch to CLASS(filename_maybe_null) 2026-01-16 12:52:04 -05:00
statfs.c user_statfs(): switch to CLASS(filename) 2026-01-16 12:52:04 -05:00
super.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
sync.c sync_file_range: delete dead S_ISLNK code 2026-05-21 13:39:36 +02:00
sysctls.c
timerfd.c fs/timerfd: Use the new alarm/hrtimer functions 2026-05-01 21:36:13 +02:00
utimes.c do_utimes_path(): switch to CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
xattr.c lsm/stable-7.2 PR 20260615 2026-06-17 12:34:16 +01:00