mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Viacheslav Dubeyko <slava@dubeyko.com>
To: torvalds@linux-foundation.org
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	 glaubitz@physik.fu-berlin.de, frank.li@vivo.com,
	Chenzhi Yang <yang.chenzhi@vivo.com>,
	Kang Chen <k.chen@smail.nju.edu.cn>
Subject: [GIT PULL] hfs/hfsplus changes for 6.18-rc1
Date: Sun, 28 Sep 2025 15:53:45 -0700	[thread overview]
Message-ID: <5d45d2ba2504ca365ac36c65cbcc6db413bf7e98.camel@dubeyko.com> (raw)

Hello Linus,

This pull request contains several fixes of syzbot reported
issues, HFS/HFS+ fixes of xfstests failures, and rework of
HFS/HFS+ debug output subsystem.

Kang Chen has fixed a slab-out-of-bounds issue in hfsplus_uni2asc()
when hfsplus_uni2asc() is called from hfsplus_listxattr().
Yang Chenzhi has fixed a crash in hfsplus_bmap_alloc() if record
offset or length is larger than node_size.
Yangtao Li made correction of returning error code from
hfsplus_fill_super() if Catalog File contains corrupted record
for the case of hidden directory's type.

The KMSAN uninit-value issue has been fixed in hfs_find_set_zero_bits()
by exchanging the kmalloc() on kzalloc() call. The KMSAN uninit-value
issue in hfsplus_delete_cat() has been fixed by proper initialization
of struct hfsplus_inode_info in the hfsplus_iget() logic. The KMSAN
uninit-value issue in __hfsplus_ext_cache_extent() has been fixed by
exchanging the kmalloc() on kzalloc() in hfs_find_init().

The slab-out-of-bounds issue could happen in hfsplus_strcasecmp()
if the length field of struct hfsplus_unistr is bigger than
HFSPLUS_MAX_STRLEN. The issue has been fixed by checking
the length of comparing strings. And if the strings' length
is bigger than HFSPLUS_MAX_STRLEN, then the length is corrected
to this value.

The generic/736 xfstest fails for HFS case because HFS volume
becomes corrupted after the test run. The main reason of
the issue is the absence of logic that corrects
mdb->drNxtCNID/HFS_SB(sb)->next_id (next unused CNID) after
deleting a record in Catalog File. It was introduced
a hfs_correct_next_unused_CNID() method that implements
the necessary logic.

The following changes since commit
8f5ae30d69d7543eee0d70083daf4de8fe15d585:

  Linux 6.17-rc1 (2025-08-10 19:41:16 +0300)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git
tags/hfs-v6.18-tag1

for you to fetch changes up to
f32a26fab3672e60f622bd7461bf978fc72f29ec:

  hfs/hfsplus: rework debug output subsystem (2025-09-24 16:30:34 -
0700)

----------------------------------------------------------------
hfs updates for v6.18

- hfs/hfsplus: rework debug output subsystem
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
- hfs: clear offset and space out of valid records in b-tree node
- hfs: add logic of correcting a next unused CNID
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
- hfs: make proper initalization of struct hfs_find_data
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
- hfs: validate record offset in hfsplus_bmap_alloc
- hfsplus: return EIO when type of hidden directory mismatch in
hfsplus_fill_super()
- MAINTAINERS: update location of hfs&hfsplus trees

----------------------------------------------------------------
Kang Chen (1):
      hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

Viacheslav Dubeyko (8):
      hfsplus: fix KMSAN uninit-value issue in
__hfsplus_ext_cache_extent()
      hfs: make proper initalization of struct hfs_find_data
      hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
      hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
      hfs: add logic of correcting a next unused CNID
      hfs: clear offset and space out of valid records in b-tree node
      hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
      hfs/hfsplus: rework debug output subsystem

Yang Chenzhi (1):
      hfs: validate record offset in hfsplus_bmap_alloc

Yangtao Li (2):
      MAINTAINERS: update location of hfs&hfsplus trees
      hfsplus: return EIO when type of hidden directory mismatch in
hfsplus_fill_super()

 MAINTAINERS                |   4 ++
 fs/hfs/bfind.c             |  12 +++--
 fs/hfs/bitmap.c            |   4 +-
 fs/hfs/bnode.c             |  28 +++++-----
 fs/hfs/brec.c              |  35 +++++++++---
 fs/hfs/btree.c             |   2 +-
 fs/hfs/catalog.c           | 129
+++++++++++++++++++++++++++++++++++++++++++--
 fs/hfs/extent.c            |  19 +++----
 fs/hfs/hfs_fs.h            |  39 ++------------
 fs/hfs/inode.c             |  25 ++++++---
 fs/hfs/mdb.c               |  20 ++++---
 fs/hfs/super.c             |   4 ++
 fs/hfsplus/attributes.c    |   8 +--
 fs/hfsplus/bfind.c         |  12 +++--
 fs/hfsplus/bitmap.c        |  10 ++--
 fs/hfsplus/bnode.c         |  69 +++++-------------------
 fs/hfsplus/brec.c          |  10 ++--
 fs/hfsplus/btree.c         |  10 +++-
 fs/hfsplus/catalog.c       |   6 +--
 fs/hfsplus/dir.c           |   2 +-
 fs/hfsplus/extents.c       |  27 +++++-----
 fs/hfsplus/hfsplus_fs.h    |  85 ++++++++++++++++-------------
 fs/hfsplus/super.c         |  41 ++++++++++----
 fs/hfsplus/unicode.c       |  48 +++++++++++++++--
 fs/hfsplus/xattr.c         |  10 ++--
 include/linux/hfs_common.h |  20 +++++++
 26 files changed, 442 insertions(+), 237 deletions(-)
 create mode 100644 include/linux/hfs_common.h

             reply	other threads:[~2025-09-28 22:53 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-28 22:53 Viacheslav Dubeyko [this message]
2025-09-29 23:22 ` pr-tracker-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5d45d2ba2504ca365ac36c65cbcc6db413bf7e98.camel@dubeyko.com \
    --to=slava@dubeyko.com \
    --cc=frank.li@vivo.com \
    --cc=glaubitz@physik.fu-berlin.de \
    --cc=k.chen@smail.nju.edu.cn \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=yang.chenzhi@vivo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®