[GIT PULL] hfs/hfsplus changes for 7.0-rc1

[GIT PULL] hfs/hfsplus changes for 7.0-rc1

[Viacheslav Dubeyko]

Hello Linus,

This pull request contains several fixes of syzbot reported
issues and HFS+ fixes of xfstests failures.

Jori Koolstra has fixed the syzbot reported issue of triggering
BUG_ON() in the case of corrupted superblock. This patch replaces
the BUG_ON() in multiple places with proper error handling and
resolves the syzbot reported bug.

Mehdi Ben Hadj Khelifa has fixed the syzbot reported issues in
mount logic of HFS/HFS+ file systems. When HFS/HFS+ were converted to
the new mount api a bug was introduced by changing the allocation
pattern of sb->s_fs_info. The memory leaks issue has been fixed
by these two patches.

Shardul Bankar suggested the nice fix in hfs_bnode_create() by
returning ERR_PTR(-EEXIST) instead of the node pointer when it's
already hashed and fix of avoiding the double unload_nls() on mount
failure.

Tetsuo Handa added logic of setting inode's mode as regular
file for the case of system inodes.

The rest patches fix issue of failures in generic/020,
generic/037, generic/062, generic/480, and generic/498
xfstests for the case of HFS+ file system. Currently,
only 30 xfstests' test-cases experience failures for HFS+
file system (initially, it was around 100 failed xfstests).

The following changes since commit
8f0b4cce4481fb22653697cced8d0d04027cb1e8:

  Linux 6.19-rc1 (2025-12-14 16:05:07 +1200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git
tags/hfs-v7.0-tag1

for you to fetch changes up to
ebebb04baefdace1e0dc17f7779e5549063ca592:

  hfsplus: avoid double unload_nls() on mount failure (2026-02-06
15:20:00 -0800)

----------------------------------------------------------------
hfs/hfsplus updates for v7.0

- hfsplus: avoid double unload_nls() on mount failure
- hfsplus: fix warning issue in inode.c
- hfsplus: fix generic/062 xfstests failure
- hfsplus: fix generic/037 xfstests failure
- hfsplus: pretend special inodes as regular files
- hfsplus: return error when node already exists in hfs_bnode_create
- hfs: Replace BUG_ON with error handling for CNID count checks
- hfsplus: fix generic/020 xfstests failure
- hfsplus: fix volume corruption issue for generic/498
- hfsplus: fix volume corruption issue for generic/480
- hfsplus: ensure sb->s_fs_info is always cleaned up
- hfs: ensure sb->s_fs_info is always cleaned up

----------------------------------------------------------------
Jori Koolstra (1):
      hfs: Replace BUG_ON with error handling for CNID count checks

Mehdi Ben Hadj Khelifa (2):
      hfs: ensure sb->s_fs_info is always cleaned up
      hfsplus: ensure sb->s_fs_info is always cleaned up

Shardul Bankar (2):
      hfsplus: return error when node already exists in
hfs_bnode_create
      hfsplus: avoid double unload_nls() on mount failure

Tetsuo Handa (1):
      hfsplus: pretend special inodes as regular files

Viacheslav Dubeyko (6):
      hfsplus: fix volume corruption issue for generic/480
      hfsplus: fix volume corruption issue for generic/498
      hfsplus: fix generic/020 xfstests failure
      hfsplus: fix generic/037 xfstests failure
      hfsplus: fix generic/062 xfstests failure
      hfsplus: fix warning issue in inode.c

 fs/hfs/dir.c            |  15 +++-
 fs/hfs/hfs_fs.h         |   1 +
 fs/hfs/inode.c          |  30 ++++++--
 fs/hfs/mdb.c            |  66 ++++++++++-------
 fs/hfs/super.c          |  13 +++-
 fs/hfsplus/attributes.c | 189 +++++++++++++++++++++++++++++++++++-----
--------
 fs/hfsplus/bnode.c      |   2 +-
 fs/hfsplus/dir.c        |  46 +++++++++++-
 fs/hfsplus/hfsplus_fs.h |   3 +
 fs/hfsplus/inode.c      |  40 +++++++++-
 fs/hfsplus/super.c      |  20 +++--
 fs/hfsplus/xattr.c      | 104 +++++++++++++++++++-------
 12 files changed, 407 insertions(+), 122 deletions(-)

Re: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[Tetsuo Handa]

On 2026/02/07 9:26, Viacheslav Dubeyko wrote:
> Hello Linus,
> 
> This pull request contains several fixes of syzbot reported
> issues and HFS+ fixes of xfstests failures.

Where is the flow for testing these patches in linux-next tree?
Are HFS/HFS+ patches directly going to linux tree without testing
in linux-next tree?

Re: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[John Paul Adrian Glaubitz]

Hi Tetsuo,

On Sat, 2026-02-07 at 10:18 +0900, Tetsuo Handa wrote:
> On 2026/02/07 9:26, Viacheslav Dubeyko wrote:
> > Hello Linus,
> > 
> > This pull request contains several fixes of syzbot reported
> > issues and HFS+ fixes of xfstests failures.
> 
> Where is the flow for testing these patches in linux-next tree?
> Are HFS/HFS+ patches directly going to linux tree without testing
> in linux-next tree?

The HFS/HFS+ tree should be part of linux-next which is why it's got
a branch named like this [1].

Adrian

> [1] https://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git/log/?h=for-next

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[Tetsuo Handa]

On 2026/02/07 17:55, John Paul Adrian Glaubitz wrote:
> Hi Tetsuo,
> 
> On Sat, 2026-02-07 at 10:18 +0900, Tetsuo Handa wrote:
>> On 2026/02/07 9:26, Viacheslav Dubeyko wrote:
>>> Hello Linus,
>>>
>>> This pull request contains several fixes of syzbot reported
>>> issues and HFS+ fixes of xfstests failures.
>>
>> Where is the flow for testing these patches in linux-next tree?
>> Are HFS/HFS+ patches directly going to linux tree without testing
>> in linux-next tree?
> 
> The HFS/HFS+ tree should be part of linux-next which is why it's got
> a branch named like this [1].
> 
> Adrian
> 
>> [1] https://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git/log/?h=for-next
> 

Oops, the patch with old Reported-by: was applied. That's why I can't find
"hfsplus: pretend special inodes as regular files" as a fix commit for
https://syzkaller.appspot.com/bug?extid=f98189ed18c1f5f32e00 as of linux-next-20250205 .

Anyway, my patch was tested for one month in linux-next tree, and
it seems that no side effect is reported. Please proceed.

Re: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[pr-tracker-bot]

The pull request you sent on Fri, 06 Feb 2026 16:26:16 -0800:

> git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git tags/hfs-v7.0-tag1

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/4fb7d86fbef0e294f4bb6bc46930c5789d332dc7

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

Re: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[Tetsuo Handa]

On 2026/02/07 9:26, Viacheslav Dubeyko wrote:
> Jori Koolstra has fixed the syzbot reported issue of triggering
> BUG_ON() in the case of corrupted superblock. This patch replaces
> the BUG_ON() in multiple places with proper error handling and
> resolves the syzbot reported bug.

I think that commit b226804532a8 ("hfs: Replace BUG_ON with error handling for CNID count checks") is incomplete.

Since atomic64_t is signed 64bits and U32_MAX is unsigned 32bits, the comparison
"if (atomic64_read(&sbi->next_id) > U32_MAX)" becomes false when sbi->next_id >= ((-1ULL) / 2) + 1.
I guess that a corrupted filesystem can have e.g. sbi->next_id == -1, and
"if (atomic64_read(&sbi->next_id) >> 32)" would check that the upper 32bits are all 0.



Also, I confirmed that this pull request did not include a fix for
https://syzkaller.appspot.com/bug?id=ee595bf9e099fff0610828e37bbbcdb7a2933f58 .
I'm waiting for next version of patch for this problem.

RE: [GIT PULL] hfs/hfsplus changes for 7.0-rc1

[Viacheslav Dubeyko]

On Tue, 2026-02-10 at 20:12 +0900, Tetsuo Handa wrote:
> On 2026/02/07 9:26, Viacheslav Dubeyko wrote:
> > Jori Koolstra has fixed the syzbot reported issue of triggering
> > BUG_ON() in the case of corrupted superblock. This patch replaces
> > the BUG_ON() in multiple places with proper error handling and
> > resolves the syzbot reported bug.
> 
> I think that commit b226804532a8 ("hfs: Replace BUG_ON with error handling for CNID count checks") is incomplete.
> 
> Since atomic64_t is signed 64bits and U32_MAX is unsigned 32bits, the comparison
> "if (atomic64_read(&sbi->next_id) > U32_MAX)" becomes false when sbi->next_id >= ((-1ULL) / 2) + 1.
> I guess that a corrupted filesystem can have e.g. sbi->next_id == -1, and
> "if (atomic64_read(&sbi->next_id) >> 32)" would check that the upper 32bits are all 0.
> 
> 
> 
> Also, I confirmed that this pull request did not include a fix for
> https://urldefense.proofpoint.com/v2/url?u=https-3A__syzkaller.appspot.com_bug-3Fid-3Dee595bf9e099fff0610828e37bbbcdb7a2933f58&d=DwICaQ&c=BSDicqBQBDjDI9RkVyTcHQ&r=q5bIm4AXMzc8NJu1_RGmnQ2fMWKq4Y4RAkElvUgSs00&m=oSYPrjvqOFJcM1QikgNde5oUhIdGdMpum5UQMLayiJS0yQrJtT-rfZXJJ6rqaBd_&s=ztXY-L3aBc2mxTwLuNk3drfU-ca8BOnIOSLbfUesA-o&e=  .
> I'm waiting for next version of patch for this problem.
> 

If something was missed in the patch, then you or Jori are welcome to send the
fix.

Thanks,
Slava.