[PATCH] hfs: fix slab-out-of-bounds in __hfs_ext_write_extent

[PATCH] hfs: fix slab-out-of-bounds in __hfs_ext_write_extent

[Roman Demidov]

The function __hfs_ext_write_extent() writes extent data to the B-tree
node using the length fd->entrylength obtained from the on-disk HFS
record without validation. This length can be larger than the actual
source buffer HFS_I(inode)->cached_extents (which is only 12 bytes,
the size of hfs_extent_rec). An attacker can craft a malicious HFS
image and mount it locally, then trigger a writeback by truncating
a file, causing the kernel to read beyond the cached_extents buffer
and leak up to 84 bytes of kernel memory into the image.

Although CVE-2025-38715 addressed similar out-of-bounds issues in the
read path and added bounds checks in hfs_bnode_write(), those checks
only verify that the write stays within the B-tree node boundaries.
A 96-byte write still fits within a typical node, so the overflow
persists in the write path.

Fix this by adding a validation in __hfs_ext_write_extent() that rejects
any write where fd->entrylength does not equal sizeof(hfs_extent_rec).
This is consistent with the existing check in the read path.

Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Signed-off-by: Roman Demidov <roman.demidov.nn@gmail.com>
---
 fs/hfs/extent.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
index 580c62981dbd..b588410f01c7 100644
--- a/fs/hfs/extent.c
+++ b/fs/hfs/extent.c
@@ -126,6 +126,8 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd)
 	} else {
 		if (res)
 			return res;
+		if (fd->entrylength != sizeof(hfs_extent_rec))
+			return -EIO;
 		hfs_bnode_write(fd->bnode, HFS_I(inode)->cached_extents, fd->entryoffset, fd->entrylength);
 		HFS_I(inode)->flags &= ~HFS_FLG_EXT_DIRTY;
 	}
-- 
2.53.0