From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl2-f12.google.com (mail-dl2-f12.google.com [74.125.229.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B9E2F3A9870 for ; Sat, 26 Sep 2026 08:40:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.229.140 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790412024; cv=none; b=D0bgeNE63ouqo/25Ha6X1F13JW6JmG9AGT3vIgIM1YvO7/dxckI3hLL5Yk/NvMA52kOBw+qlBxvy9Gz86hIuE1faNmotaZ+gG54LhFe4xwlkQrDD0IqDxZ8mLxUuq5SXQ3bUEwGw3HGj/GzARusDY20pqCzw2Mt+q59TxM+mMk0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790412024; c=relaxed/simple; bh=1IEJMlGAIYVWIyCpVTvFsjv9mqTl9ZIrhLv8OC00Sjg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hSPx2m0nUvD+289aaiuVguMjlA5CN9iOD5c8t4dHHe16t6G4BzLMsvKOpx8dbREAFivRZbI5qhdt9/F5oz7F/8PybhCAwXkfdYQGKVzfm2Chd53o4GW4oEvv99XaBd0sdPBXFhnd3c9nCzNPrxbISwyW9/IWWGeKpUlVj+BVHz4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bDS4uO8C; arc=none smtp.client-ip=74.125.229.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bDS4uO8C" Received: by mail-dl2-f12.google.com with SMTP id a92af1059eb24-142dd04edb5so2624192c88.2 for ; Sat, 26 Sep 2026 01:40:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790412019; x=1791016819; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mVOD72O7nP3D+t7jG+Ciq4o1ZIEF31Fn6i5vDIyMLpo=; b=bDS4uO8CczKZAkaJ+vONeD4ckpOPpqcv3SZOcVBQSDuefWAtkuLNWUgF3XrKWJ8cyS /VlNpPh0PTZg5KsPEXWkmaP3IDxqQL+LCfY817Mt7CIpGIQ28YQZh1y+BG0hsPVF3zUv f0IzJ7p0SjTf1soTy4ZnkK2aAhDVJGF0DVXG0CA73BDlz/AwrXoHu3IHVl3KNvl7omED XTIPyOiLcDFZu6YydQoyO+iNihCHIwBLxEQdYJnoaTBcpfwlPS3ScR4GmT7A+WuHG9qp Ppbz2sv5ggVTpXffF6MHD8ngMZQS4cytMx+Xyai5utuwg2YgdgHJMYSkg8d3ehi1dwMu /jZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790412019; x=1791016819; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=mVOD72O7nP3D+t7jG+Ciq4o1ZIEF31Fn6i5vDIyMLpo=; b=Mvdbz7nbB+RWeA2808qtXk9U58+YbFhDJ5nl2Ji0+vhDbKi8XtnVVpPVSHlZaJ9DyZ Xb+x4dcdYmJVbn0ktFlwo5kdDc7OiDAo3AWq1iowBJylQjlipZLKqBhdBRj3tnH0ASjk C13R0v6Sl8IDcX5r/8xV8Mtc+i7OOUExkvhYMKz8EU3WZGM/Vc8xGLMwkUVKTkeXjC6i eKI5Oe5c9KJzt2WIC/9TiYO2ZwVLQ/blcciDmMtZ+PxNuXrXA2NVt4a2qhiDgkFVzngk dgzb9HFeEGAq82OTC/V8nxJm3IdVHWyzHkvQT2WgLiA4GWfj0HUMzfPqwBtcb6xuTjWn Lpdw== X-Forwarded-Encrypted: i=1; AKwUvBy4Mlu5txzmVkNJUMFu8gQo08KflxAleFJ9S8npReEMq+WP77lMCLKkcuowEoQaUCXgzKMRG3FLMHZmFO4=@vger.kernel.org X-Gm-Message-State: AFuF++kBy947vKSn/O/1GOhoXQ5NrxUw1N160YRm4kxNPRN59kWCUFVH 6QpGSpVU88ia0KY8YxdYc+hjQth13mtqeiVQHEwo3Czciz89T3jGYDNoztl1mW+9TvRAFkMb X-Gm-Gg: AYBFou0hKHJDq3gKrwju2/gmLYgAZLh5urEOli0SX0Afa4aonlLyVoBIfovds53yewD /XuCkHYfKiVrSp3MIYYjHR/FI0BAxpBSYoYqNvBs6YZMFJ/ok5vGKVab+C07mEwxUBK23Y/RzYM RarjAejEfdxvbjOTccSmF4H+IM5X3xmbZ19lebIKsfj+FdIEtrodDD718yAri1DqCNCX+PVPzGN RdfPStbCZVEHSGqOjzVBTCf85t4JgIbtdeIuaBOfbQ38Ans/2qeALKIy8fkAr3d3t1lqnxcyt3p 38Q7nNQ5TwKW+muQ6M2wEUmcUGc5fKR+sH/K17dF9TZCJ7ELbGaKfvgQmdHKKN7HBktIlMAhEh2 zO/cYyLS2C1kx7ef+qpF022qlJu3I+AnJGgoX54Ph54vmYh8SVuz7hwgkAfy2pHixtE7VCHxHkQ 3Ve/espLl7/O57HtOmhJgej3nKyTfjdIlG6HE8qgDn1tzAYaQG8GQTNu85CPXCgGhdu6izMdEWC 3VbaEMFVCQ2UftnBVgGqBkW0UA7TH1aF/A76wf3fcldukr0z5FuMjk2He7PkWapKGAWGgiRRsYH gAaaYYSIAzmf9OD020p18Gh0O68rbM/T2Tgi+zXPFsjym7nCYXbB3VrCbJQ= X-Received: by 2002:a05:701b:4589:b0:13f:c741:a4f1 with SMTP id a92af1059eb24-146d00b7369mr2602300c88.23.1790412018623; Sat, 26 Sep 2026 01:40:18 -0700 (PDT) Received: from spider.bream-herring.ts.net ([103.6.151.236]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-145a7318afcsm10487044c88.0.2026.09.26.01.40.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 01:40:18 -0700 (PDT) From: Matthias Goergens To: Viacheslav Dubeyko Cc: John Paul Adrian Glaubitz , Yangtao Li , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] hfsplus: bound the wrapper and partition-table hops in hfsplus_read_wrapper() Date: Sat, 26 Sep 2026 16:40:10 +0800 Message-ID: <20260926084010.569552-3-matthias.goergens@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260926084010.569552-1-matthias.goergens@gmail.com> References: <20260926084010.569552-1-matthias.goergens@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit hfsplus_read_wrapper() rereads the volume header through a bare "goto reread", following an HFS wrapper's embedded-volume descriptor or, if the header matches neither signature, the partition-table fallback it shares with hfs, with no bound on either. A descriptor or partition entry with a zero offset leaves part_start where it was, and the mount loops forever. TN1150 ("HFS Plus Volume Format") requires a wrapper's embedded volume to be HFS Plus: "When an HFS Plus volume is embedded, drEmbedSigWord must be kHFSPlusSigWord ('H+')". So there is at most one wrapper hop, and Apple's hfs code, GRUB and 7-Zip all follow it once. A partition map sits at the start of the raw device (previous patch), so a partition-table hop only makes sense before any wrapper hop. Allow one of each, in that order, and fail with -EINVAL otherwise. A zero offset is caught on the second pass. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Matthias Goergens --- A wrapper whose embedded-volume descriptor points back at itself hangs the mount forever without this patch and fails at once with it: img=hfsplus-wrapper-loop.img put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc status=none; } truncate --size=64K $img put $((1024 + 0x00)) '\x42\x44' # drSigWord 'BD' put $((1024 + 0x0a)) '\x82\x00' # drAtrb: SLOCK | SPARED put $((1024 + 0x14)) '\x00\x00\x02\x00' # drAlBlkSiz 512 put $((1024 + 0x7c)) '\x48\x2b' # drEmbedSigWord 'H+' put $((1024 + 0x7e)) '\x00\x00\x00\x64' # drEmbedExtent: start 0, count 100 mount -o ro,loop -t hfsplus $img /mnt The same partition-table entry as the hfs patch hangs an hfsplus mount the same way: img=hfsplus-partmap-loop.img put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc status=none; } truncate --size=64K $img put $((512+0x00)) '\x50\x4d' # pmSig 'PM' put $((512+0x04)) '\x00\x00\x00\x01' # pmMapBlkCnt 1 put $((512+0x08)) '\x00\x00\x00\x00' # pmPyPartStart 0 (self) put $((512+0x0c)) '\x00\x00\x00\x64' # pmPartBlkCnt 100 put $((512+0x30)) 'Apple_HFS' # pmPartType mount -o ro,loop -t hfsplus $img /mnt --- fs/hfsplus/wrapper.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 30cf4fe78b3d..df8079a4d8f5 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -137,6 +137,7 @@ int hfsplus_read_wrapper(struct super_block *sb) struct hfsplus_wd wd; sector_t part_start, part_size; u32 blocksize; + bool part_hop_done = false, wrapper_hop_done = false; int error = 0; error = -EINVAL; @@ -172,21 +173,35 @@ int hfsplus_read_wrapper(struct super_block *sb) case cpu_to_be16(HFSPLUS_VOLHEAD_SIG): break; case cpu_to_be16(HFSP_WRAP_MAGIC): + /* + * The embedded volume must be HFS Plus (TN1150), so a + * second wrapper is corrupt; a descriptor pointing at + * itself would otherwise loop forever. + */ + if (wrapper_hop_done) + goto out_free_backup_vhdr; if (!hfsplus_read_mdb(sbi->s_vhdr, &wd)) goto out_free_backup_vhdr; wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT; part_start += (sector_t)wd.ablk_start + (sector_t)wd.embed_start * wd.ablk_size; part_size = (sector_t)wd.embed_count * wd.ablk_size; + wrapper_hop_done = true; goto reread; default: /* * Check for a partition block. * * (should do this only for cdrom/loop though) + * + * The partition map is at the start of the device: follow + * it at most once, and not from inside a wrapper. */ + if (part_hop_done || wrapper_hop_done) + goto out_free_backup_vhdr; if (hfs_part_find(sb, &part_start, &part_size)) goto out_free_backup_vhdr; + part_hop_done = true; goto reread; } -- 2.55.0