Skip to content

hfs/hfsplus: fix OOB access and uninit-value in bnode operations

Tristan Madani linux-fsdevel lkml stable 2 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v2 Latest2 patches 5 repliesIn review
  2. v13 patches 3 repliesSuperseded

Changes in v2 from the cover letter

- Patch 1: use (u64) widening cast per Dubeyko's feedback
- Patch 2: memset inside hfs_bnode_read() covering all callers in both fs/hfs/ and fs/hfsplus/, per Dubeyko's feedback
- Dropped patch 3 (NULL deref in hfsplus_create_attributes_file):
already fixed by Dubeyko's patch [1]

[1] https://lore.kernel.org/linux-fsdevel/[email protected]/

Patches in v2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2hfs/hfsplus: fix u32 overflow in check_and_correct_requested_lengthfs/hfs/bnode.c fs/hfsplus/hfsplus_fs.h+2 -21 reply
2/2hfs/hfsplus: zero-initialize buffer in hfs_bnode_readfs/hfs/bnode.c fs/hfsplus/bnode.c+4 -04 replies

Reviews trailers per patch

All 2 patches have a Reviewed-by or Acked-by.

Patch[email protected][email protected][email protected]Viacheslav Dubeyko
1/2T-b T-b R-b
2/2T-b R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 4 reviewers.

Read the v2 thread

Cover letter [PATCH v2 0/2] hfs/hfsplus: fix OOB access and uninit-value in bnode operations

From: Tristan Madani <[email protected]>

Two fixes for long-standing syzbot reports in the HFS/HFS+ B-tree node handling code.

Changes since v1 (20260501110218.29906-{1..3}[email protected]):
- Patch 1: use (u64) widening cast per Dubeyko's feedback
- Patch 2: memset inside hfs_bnode_read() covering all callers in both fs/hfs/ and fs/hfsplus/, per Dubeyko's feedback
- Dropped patch 3 (NULL deref in hfsplus_create_attributes_file):
already fixed by Dubeyko's patch [1]

[1] https://lore.kernel.org/linux-fsdevel/[email protected]/

Tristan Madani (2):
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

 fs/hfs/bnode.c          | 4 +++-
 fs/hfsplus/bnode.c      | 2 ++
 fs/hfsplus/hfsplus_fs.h | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)
Signature · 1 line
2.47.3

Read the cover letter in its thread