From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C59A37105D for ; Fri, 17 Apr 2026 22:03:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776463406; cv=none; b=uDFV3Sp199vpBN9podzlEOInDBIXYikjUMKQBh0/FCgq3r9VuJreV4va8jOnqS2rGRG4I3vzTh7fbsrUIDZK1bZR9q4PMKV7X4qUROp1QL/47ADBH6rMcj7SuhOFrJMSra20Fy7LDp2OLXLPpFU71xWtfgmyRqiC05ePAJOd6wk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776463406; c=relaxed/simple; bh=vB41k32LbV2UonMRsmOb/yQltXeD3/4LUHEJBQeG5bM=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=FFEpgzMKXhs+dVCP5WKb/XWHc1P8ufCoyVQyKRoZIKOxoZVW+ERv+TUn0jPJr2NBmxIJf7/ShAafvAp7BkkNhpzyYpKCClTEULwzwVpveD4b+2yPZxGdUehkrfApIOACbx4lDgnAHum+5Jk8tpyeJs07icmRmuX/T9Wn9sTVbb0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SXFr1XiS; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=cdbLlWLw; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SXFr1XiS"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="cdbLlWLw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776463404; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=r1q/hOKAYMwZs39a5k42c08xi2TGEQ6H1qxtQxkEfyg=; b=SXFr1XiSf2i8iAaMt7OcnzAy8AmhPawx2G4N+m7RpG1FPZTEqptmEEyWY7NkS5Kll7OV/1 kOVTU3tvx3PBNDPvdAWpr1Ytg50DYhtdr7t8wAsYUHF+crcicgDznIZ2Jc/MXEMM3BzqD7 9KS9Y+ayUQzpea3YGY4Tpwu3B9VTjG0= Received: from mail-yw1-f197.google.com (mail-yw1-f197.google.com [209.85.128.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-407-aW1VPt75MkOmnNKFMdjweg-1; Fri, 17 Apr 2026 18:03:20 -0400 X-MC-Unique: aW1VPt75MkOmnNKFMdjweg-1 X-Mimecast-MFC-AGG-ID: aW1VPt75MkOmnNKFMdjweg_1776463400 Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-7b7e80f7a8bso28037827b3.3 for ; Fri, 17 Apr 2026 15:03:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1776463400; x=1777068200; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=r1q/hOKAYMwZs39a5k42c08xi2TGEQ6H1qxtQxkEfyg=; b=cdbLlWLwt/pr5U9g+iTaF7NRKG1bv9RNZmXKFemVMMk9895QaoOKArU25zxcIRAZ5h AVavqVbvpcpvaHHacecoezcVa8OhEO5y9BNXs3lnzmQ5+gjNfA8Kl9nRIdjo8TVflORm 3HqFgjV2QzUfDl/8N3vwH+x4fyWDpynE2EMpVXqbVwvGLlCIXw8yCs7y4SP87TWY6Wjg uSzXAXJPGaHeiBM/7ejzGJLn7y6w7qH5CiI3EF8fX1QVd1KdlQpkCUxuBbaCPID85MOx /8wJA3d7LrpYoXjkkGUwhragjWxjzokwJuywBeLUQvxuaRMR5BJSE2wLIAQLHBtUNSkU skQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776463400; x=1777068200; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=r1q/hOKAYMwZs39a5k42c08xi2TGEQ6H1qxtQxkEfyg=; b=TUT33mMV16E6DLEihN02s81DxXNHr6rkF8k47j1I8aCq4NmuwJRNMiIFO2MU5mwJKF 6xGVSfXvxlQ4SbJSiPON5Ei83u5hYD74jlsdFGgr2qCeAJRldO7Ki8QwLTZxdYpLNnZb QZr5ReH6N6DdusHnsQF2UoSA/4qyKCS5hWx5Y9ix917eEhzK6jguj9nZ6PP47tbKmhvc YmNE8I/T1s6FzjqiFMyLz1nmSYX1OBGKQWzCmif81x7CqsbsXqzf0Oh+WcrIsUlrxzMH NSTyosrDtNWxp+tOiJqTrDV9D49BUwFvTRd0jCW6m6Q5SHlU8YBAACCPVyXiFORmAhsx Uw1A== X-Forwarded-Encrypted: i=1; AFNElJ/qkBEkeMCEYhZYIYFTdimcn6pT3GC3Ew++/PeOYMulYAw6op3OBL0Fy5F32cOIImJpHDkDAlyo/nQWVGI=@vger.kernel.org X-Gm-Message-State: AOJu0YxHOioJXJXtUhdf4XhRhgvqmg7UDObtVZjz6wMaCiMsgXijy9Zv wlEQhY2TT7X4mcx1HlMgn9owwrNaN2b65bciC+9FLuB+vd+RHs5gaQX7g/bHt63B21p/IGQ4//F wCw++wYe5kyx1UKtH0Mr+I1Oj2oFprPZbSelemBUsuOtvqi1Z7rMRXHq2mixVNdiARQ== X-Gm-Gg: AeBDiev156febHmTuA0B8r76+BJ0gp5qGW1PxD1JFlkSjb79xF1KSpxihhs8+10TeZD 6JRx68hTMOWPppb9QQj0dJ48061+P3qQnYmVOmXPwrvXCWj5bjlIApRIYPmbGU4sYMn7C6rAvDm zAVw/Vura6V3xOIkBr+TI8dlfn+T0V2lX2/ME8OF0PXOIL235Y/pDNeMbFeDJfRHHsOPNEdoJq5 Kt7ZhVqCCFEVs5oQ/IBseuvxs/H31PMdAI5tSQb1n3fqCoFkGCIaelGQn9cSFR26oYf9YHdzFzL 0RIDK08KCVnJxf1rX4MhLKwVPQjE2OIrFvRl0wgIv7uWZ1Rq0k13g0MnmTBMSWQhZgEbTpKwW5l zE1o/L4uIwTm/mO0LwauZQNgCAuY0F0QhGQuQs46dXpfGoiRWlFPDv3RYjPAgXrs= X-Received: by 2002:a05:690c:d8d:b0:7b1:fa45:72e3 with SMTP id 00721157ae682-7b9ece5ab23mr56682487b3.4.1776463399662; Fri, 17 Apr 2026 15:03:19 -0700 (PDT) X-Received: by 2002:a05:690c:d8d:b0:7b1:fa45:72e3 with SMTP id 00721157ae682-7b9ece5ab23mr56681897b3.4.1776463399096; Fri, 17 Apr 2026 15:03:19 -0700 (PDT) Received: from li-4c4c4544-0032-4210-804c-c3c04f423534.ibm.com ([2600:1700:6476:1430::29]) by smtp.gmail.com with ESMTPSA id 00721157ae682-7b9ee99b672sm12846097b3.29.2026.04.17.15.03.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Apr 2026 15:03:18 -0700 (PDT) Message-ID: <60605973b66496b04c6847ceb6fa46dfada6a628.camel@redhat.com> Subject: Re: [PATCH] hfsplus: Supports freeing newly created tree head From: Viacheslav Dubeyko To: Edward Adam Davis , syzbot+98547b0428b6a6a3467c@syzkaller.appspotmail.com Cc: frank.li@vivo.com, glaubitz@physik.fu-berlin.de, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, slava@dubeyko.com, syzkaller-bugs@googlegroups.com Date: Fri, 17 Apr 2026 15:03:17 -0700 In-Reply-To: References: <69e1934c.a70a0220.7229.0011.GAE@google.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43app2) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Fri, 2026-04-17 at 14:58 +0800, Edward Adam Davis wrote: > hfs_bnode_put() does not support deallocating a newly created btree > head node; therefore, regardless of whether hfsplus_bnode_find() succeeds > or fails, it cannot effectively reclaim the memory allocated for a newly > created head node. >=20 > When finding a head node, if the node is a newly created one, we can use > hfs_bnode_free() to reclaim its memory. >=20 > [1] > BUG: memory leak > unreferenced object 0xffff88811cabc840 (size 96): > backtrace (crc 3e2dadb7): > __hfs_bnode_create+0x59/0x310 fs/hfsplus/bnode.c:469 > hfsplus_bnode_find+0x13e/0x580 fs/hfsplus/bnode.c:547 > hfsplus_btree_open+0x2fa/0x6d0 fs/hfsplus/btree.c:382 > hfsplus_fill_super+0x272/0x880 fs/hfsplus/super.c:548 I need slightly more detailed and clear explanation how the issue has been happened and why we need to fix it in a such way. Currently, I don't have t= he complete picture how this happened. I am sure that you have the complete picture. :) Could you please share what you have in your mind? :) Don't hid= e the wisdom. ;) Thanks, Slava. >=20 > Fixes: 8ad2c6a36ac4 ("hfsplus: validate b-tree node 0 bitmap at mount tim= e") > Reported-by: syzbot+98547b0428b6a6a3467c@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=3D98547b0428b6a6a3467c > Tested-by: syzbot+98547b0428b6a6a3467c@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis > --- > fs/hfsplus/bnode.c | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) >=20 > diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c > index f8b5a8ae58ff..65902104882a 100644 > --- a/fs/hfsplus/bnode.c > +++ b/fs/hfsplus/bnode.c > @@ -598,14 +598,18 @@ struct hfs_bnode *hfs_bnode_find(struct hfs_btree *= tree, u32 num) > if (key_size >=3D entry_size || key_size & 1) > goto node_error; > } > - clear_bit(HFS_BNODE_NEW, &node->flags); > - wake_up(&node->lock_wq); > + if (num !=3D HFSPLUS_TREE_HEAD) { > + clear_bit(HFS_BNODE_NEW, &node->flags); > + wake_up(&node->lock_wq); > + } > return node; > =20 > node_error: > set_bit(HFS_BNODE_ERROR, &node->flags); > - clear_bit(HFS_BNODE_NEW, &node->flags); > - wake_up(&node->lock_wq); > + if (num !=3D HFSPLUS_TREE_HEAD) { > + clear_bit(HFS_BNODE_NEW, &node->flags); > + wake_up(&node->lock_wq); > + } > hfs_bnode_put(node); > return ERR_PTR(-EIO); > } > @@ -694,6 +698,10 @@ void hfs_bnode_put(struct hfs_bnode *node) > hfs_bnode_free(node); > return; > } > + if (test_bit(HFS_BNODE_NEW, &node->flags)) { > + hfs_bnode_unhash(node); > + hfs_bnode_free(node); > + } > spin_unlock(&tree->hash_lock); > } > }