[PATCH] hfs: return error when bnode already hashed in hfs_bnode_create

[Tristan Madani <tristmd@gmail.com>]

hfs_bnode_create() checks if the requested node number is already
present in the B-tree hash table.  If it is, the function emits a
WARN_ON(1) and returns the existing node:

    if (node) {
        pr_crit("new node %u already hashed?\n", num);
        WARN_ON(1);
        return node;
    }

On crafted HFS images with inconsistent B-tree bitmap data, the
allocator can repeatedly request creation of node 0 which is
already hashed, triggering this WARNING reliably on every mkdir.

Replace the WARN_ON with an error return.  The node being already
hashed when creation is requested indicates filesystem corruption
-- returning ERR_PTR(-EIO) allows the caller to handle this
gracefully rather than generating a kernel stack trace.

Reported-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Tested-by: syzbot+a19ca73b21fe8bc69101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfs/bnode.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index e8cd1a31f247..69895ccf81ef 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -517,8 +517,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	spin_unlock(&tree->hash_lock);
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
-		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EIO);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)
-- 
2.47.3