tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

hfsplus: fix uninit-value by validating catalog record size

Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The
root cause is that hfs_brec_read() doesn't validate that the on-disk
record size matches the expected size for the record type being read.

When mounting a corrupted filesystem, hfs_brec_read() may read less data
than expected. For example, when reading a catalog thread record, the
debug output showed:

HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26
HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!

hfs_brec_read() only validates that entrylength is not greater than the
buffer size, but doesn't check if it's less than expected. It successfully
reads 26 bytes into a 520-byte structure and returns success, leaving 494
bytes uninitialized.

This uninitialized data in tmp.thread.nodeName then gets copied by
hfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering
the KMSAN warning when the uninitialized bytes are used as array indices
in case_fold().

Fix by introducing hfsplus_brec_read_cat() wrapper that:
1. Calls hfs_brec_read() to read the data
2. Validates the record size based on the type field:
- Fixed size for folder and file records
- Variable size for thread records (depends on string length)
3. Returns -EIO if size doesn't match expected

For thread records, check against HFSPLUS_MIN_THREAD_SZ before reading
nodeName.length to avoid reading uninitialized data at call sites that
don't zero-initialize the entry structure.

Also initialize the tmp variable in hfsplus_find_cat() as defensive
programming to ensure no uninitialized data even if validation is
bypassed.

Reported-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d80abb5b890d39261e72
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Suggested-by: Charalampos Mitrodimas <charmitro@posteo.net>
Link: https://lore.kernel.org/all/20260120051114.1281285-1-kartikey406@gmail.com/ [v1]
Link: https://lore.kernel.org/all/20260121063109.1830263-1-kartikey406@gmail.com/ [v2]
Link: https://lore.kernel.org/all/20260212014233.2422046-1-kartikey406@gmail.com/ [v3]
Link: https://lore.kernel.org/all/20260214002100.436125-1-kartikey406@gmail.com/T/ [v4]
Link: https://lore.kernel.org/all/20260221061626.15853-1-kartikey406@gmail.com/T/ [v5]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260307010302.41547-1-kartikey406@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>

authored by

Deepanshu Kartikey and committed by
Viacheslav Dubeyko b6b59227 ee8422d0

+64 -4
+51
fs/hfsplus/bfind.c
··· 287 287 fd->bnode = bnode; 288 288 return res; 289 289 } 290 + 291 + /** 292 + * hfsplus_brec_read_cat - read and validate a catalog record 293 + * @fd: find data structure 294 + * @entry: pointer to catalog entry to read into 295 + * 296 + * Reads a catalog record and validates its size matches the expected 297 + * size based on the record type. 298 + * 299 + * Returns 0 on success, or negative error code on failure. 300 + */ 301 + int hfsplus_brec_read_cat(struct hfs_find_data *fd, hfsplus_cat_entry *entry) 302 + { 303 + int res; 304 + u32 expected_size; 305 + 306 + res = hfs_brec_read(fd, entry, sizeof(hfsplus_cat_entry)); 307 + if (res) 308 + return res; 309 + 310 + /* Validate catalog record size based on type */ 311 + switch (be16_to_cpu(entry->type)) { 312 + case HFSPLUS_FOLDER: 313 + expected_size = sizeof(struct hfsplus_cat_folder); 314 + break; 315 + case HFSPLUS_FILE: 316 + expected_size = sizeof(struct hfsplus_cat_file); 317 + break; 318 + case HFSPLUS_FOLDER_THREAD: 319 + case HFSPLUS_FILE_THREAD: 320 + /* Ensure we have at least the fixed fields before reading nodeName.length */ 321 + if (fd->entrylength < HFSPLUS_MIN_THREAD_SZ) { 322 + pr_err("thread record too short (got %u)\n", fd->entrylength); 323 + return -EIO; 324 + } 325 + expected_size = hfsplus_cat_thread_size(&entry->thread); 326 + break; 327 + default: 328 + pr_err("unknown catalog record type %d\n", 329 + be16_to_cpu(entry->type)); 330 + return -EIO; 331 + } 332 + 333 + if (fd->entrylength != expected_size) { 334 + pr_err("catalog record size mismatch (type %d, got %u, expected %u)\n", 335 + be16_to_cpu(entry->type), fd->entrylength, expected_size); 336 + return -EIO; 337 + } 338 + 339 + return 0; 340 + }
+2 -2
fs/hfsplus/catalog.c
··· 194 194 int hfsplus_find_cat(struct super_block *sb, u32 cnid, 195 195 struct hfs_find_data *fd) 196 196 { 197 - hfsplus_cat_entry tmp; 197 + hfsplus_cat_entry tmp = {0}; 198 198 int err; 199 199 u16 type; 200 200 201 201 hfsplus_cat_build_key_with_cnid(sb, fd->search_key, cnid); 202 - err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry)); 202 + err = hfsplus_brec_read_cat(fd, &tmp); 203 203 if (err) 204 204 return err; 205 205
+1 -1
fs/hfsplus/dir.c
··· 49 49 if (unlikely(err < 0)) 50 50 goto fail; 51 51 again: 52 - err = hfs_brec_read(&fd, &entry, sizeof(entry)); 52 + err = hfsplus_brec_read_cat(&fd, &entry); 53 53 if (err) { 54 54 if (err == -ENOENT) { 55 55 hfs_find_exit(&fd);
+9
fs/hfsplus/hfsplus_fs.h
··· 516 516 void **data, blk_opf_t opf); 517 517 int hfsplus_read_wrapper(struct super_block *sb); 518 518 519 + static inline u32 hfsplus_cat_thread_size(const struct hfsplus_cat_thread *thread) 520 + { 521 + return offsetof(struct hfsplus_cat_thread, nodeName) + 522 + offsetof(struct hfsplus_unistr, unicode) + 523 + be16_to_cpu(thread->nodeName.length) * sizeof(hfsplus_unichr); 524 + } 525 + 526 + int hfsplus_brec_read_cat(struct hfs_find_data *fd, hfsplus_cat_entry *entry); 527 + 519 528 /* 520 529 * time helpers: convert between 1904-base and 1970-base timestamps 521 530 *
+1 -1
fs/hfsplus/super.c
··· 571 571 err = hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str); 572 572 if (unlikely(err < 0)) 573 573 goto out_put_root; 574 - if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { 574 + if (!hfsplus_brec_read_cat(&fd, &entry)) { 575 575 hfs_find_exit(&fd); 576 576 if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { 577 577 err = -EIO;