[PATCH 0/2] hfs, hfsplus: bound the partition-table and wrapper hops

[PATCH 0/2] hfs, hfsplus: bound the partition-table and wrapper hops

[Matthias Goergens]

hfs_mdb_get() and hfsplus_read_wrapper() follow a partition table, and
hfsplus also an HFS wrapper, back to the volume header with no bound on
how often.  A partition entry or wrapper descriptor with a zero offset
sends the loop back to the header it has just read, and a crafted image
hangs the mount.

These patches allow each kind of hop at most once: one partition-table
hop, before any wrapper hop, and one wrapper hop.  TN1150 requires a
wrapper's embedded volume to be HFS Plus, so a second wrapper is never
valid.  Apple documents no nested partition maps, and neither macOS nor
the boot ROM reads one.  With both limits, plain, wrapped, partitioned
and partitioned-then-wrapped volumes still mount under QEMU.

If you would rather not rely on that, the alternative is to reject only
a hop that does not advance part_start.  Both hops add unsigned offsets,
so the loop then always ends, but a crafted chain of one-sector hops
can cost a synchronous read per sector of the device before it does,
which on slow media such as a CD adds up.  I can send that instead.

Matthias Goergens (2):
  hfs: bound the partition-table hop in hfs_mdb_get()
  hfsplus: bound the wrapper and partition-table hops in
    hfsplus_read_wrapper()

 fs/hfs/mdb.c         | 10 +++++++++-
 fs/hfsplus/wrapper.c | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

-- 
2.55.0

[PATCH 1/2] hfs: bound the partition-table hop in hfs_mdb_get()

[Matthias Goergens]

hfs_mdb_get() loops "while (1)" around hfs_part_find(), rereading the
volume header wherever the partition table points.  A partition entry
with a zero start (pdStart or pmPyPartStart) leaves part_start where it
was, and the loop reads the same blocks forever.

An Apple partition map sits at the start of the raw device: the boot ROM
reads it from block 1 (TN1189), and nothing Apple documents nests one
inside a partition.  Follow at most one partition-table hop and fail
with -EIO after that, as for a table that cannot be parsed.  A zero
start is caught on the second pass, when the loop comes round again.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
---
A partition entry pointing at its own table hangs the mount forever
without this patch and fails at once with it:

  img=hfs-partmap-loop.img
  put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc status=none; }
  truncate --size=64K $img
  put $((512+0x00)) '\x50\x4d'          # pmSig 'PM'
  put $((512+0x04)) '\x00\x00\x00\x01'  # pmMapBlkCnt 1
  put $((512+0x08)) '\x00\x00\x00\x00'  # pmPyPartStart 0 (self)
  put $((512+0x0c)) '\x00\x00\x00\x64'  # pmPartBlkCnt 100
  put $((512+0x30)) 'Apple_HFS'         # pmPartType
  mount -o ro,loop -t hfs $img /mnt
---
 fs/hfs/mdb.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 277de712f9d4..1704f332e28d 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -134,6 +134,7 @@ int hfs_mdb_get(struct super_block *sb)
 	sector_t part_start, part_size;
 	loff_t off;
 	__be16 attrib;
+	bool part_hop_done = false;
 
 	/* set the device driver to 512-byte blocks */
 	size = sb_min_blocksize(sb, HFS_SECTOR_SIZE);
@@ -152,11 +153,18 @@ int hfs_mdb_get(struct super_block *sb)
 			break;
 		brelse(bh);
 
-		/* check for a partition block
+		/*
+		 * check for a partition block
 		 * (should do this only for cdrom/loop though)
+		 *
+		 * The partition map is at the start of the device: follow
+		 * it once, or an entry pointing at itself loops forever.
 		 */
+		if (part_hop_done)
+			return -EIO;
 		if (hfs_part_find(sb, &part_start, &part_size))
 			return -EIO;
+		part_hop_done = true;
 	}
 
 	HFS_SB(sb)->alloc_blksz = size = be32_to_cpu(mdb->drAlBlkSiz);

base-commit: 6812ce4e4379ffc99c52401ec28f0d7ffbc36206
-- 
2.55.0

[PATCH 2/2] hfsplus: bound the wrapper and partition-table hops in hfsplus_read_wrapper()

[Matthias Goergens]

hfsplus_read_wrapper() rereads the volume header through a bare "goto
reread", following an HFS wrapper's embedded-volume descriptor or, if
the header matches neither signature, the partition-table fallback it
shares with hfs, with no bound on either.  A descriptor or partition
entry with a zero offset leaves part_start where it was, and the mount
loops forever.

TN1150 ("HFS Plus Volume Format") requires a wrapper's embedded volume
to be HFS Plus: "When an HFS Plus volume is embedded, drEmbedSigWord
must be kHFSPlusSigWord ('H+')".  So there is at most one wrapper hop,
and Apple's hfs code, GRUB and 7-Zip all follow it once.  A partition
map sits at the start of the raw device (previous patch), so a
partition-table hop only makes sense before any wrapper hop.  Allow one
of each, in that order, and fail with -EINVAL otherwise.  A zero offset
is caught on the second pass.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
---
A wrapper whose embedded-volume descriptor points back at itself
hangs the mount forever without this patch and fails at once with it:

  img=hfsplus-wrapper-loop.img
  put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc status=none; }
  truncate --size=64K $img
  put $((1024 + 0x00)) '\x42\x44'          # drSigWord 'BD'
  put $((1024 + 0x0a)) '\x82\x00'          # drAtrb: SLOCK | SPARED
  put $((1024 + 0x14)) '\x00\x00\x02\x00'  # drAlBlkSiz 512
  put $((1024 + 0x7c)) '\x48\x2b'          # drEmbedSigWord 'H+'
  put $((1024 + 0x7e)) '\x00\x00\x00\x64'  # drEmbedExtent: start 0, count 100
  mount -o ro,loop -t hfsplus $img /mnt

The same partition-table entry as the hfs patch hangs an hfsplus mount
the same way:

  img=hfsplus-partmap-loop.img
  put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc status=none; }
  truncate --size=64K $img
  put $((512+0x00)) '\x50\x4d'          # pmSig 'PM'
  put $((512+0x04)) '\x00\x00\x00\x01'  # pmMapBlkCnt 1
  put $((512+0x08)) '\x00\x00\x00\x00'  # pmPyPartStart 0 (self)
  put $((512+0x0c)) '\x00\x00\x00\x64'  # pmPartBlkCnt 100
  put $((512+0x30)) 'Apple_HFS'         # pmPartType
  mount -o ro,loop -t hfsplus $img /mnt
---
 fs/hfsplus/wrapper.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 30cf4fe78b3d..df8079a4d8f5 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -137,6 +137,7 @@ int hfsplus_read_wrapper(struct super_block *sb)
 	struct hfsplus_wd wd;
 	sector_t part_start, part_size;
 	u32 blocksize;
+	bool part_hop_done = false, wrapper_hop_done = false;
 	int error = 0;
 
 	error = -EINVAL;
@@ -172,21 +173,35 @@ int hfsplus_read_wrapper(struct super_block *sb)
 	case cpu_to_be16(HFSPLUS_VOLHEAD_SIG):
 		break;
 	case cpu_to_be16(HFSP_WRAP_MAGIC):
+		/*
+		 * The embedded volume must be HFS Plus (TN1150), so a
+		 * second wrapper is corrupt; a descriptor pointing at
+		 * itself would otherwise loop forever.
+		 */
+		if (wrapper_hop_done)
+			goto out_free_backup_vhdr;
 		if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))
 			goto out_free_backup_vhdr;
 		wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
 		part_start += (sector_t)wd.ablk_start +
 			       (sector_t)wd.embed_start * wd.ablk_size;
 		part_size = (sector_t)wd.embed_count * wd.ablk_size;
+		wrapper_hop_done = true;
 		goto reread;
 	default:
 		/*
 		 * Check for a partition block.
 		 *
 		 * (should do this only for cdrom/loop though)
+		 *
+		 * The partition map is at the start of the device: follow
+		 * it at most once, and not from inside a wrapper.
 		 */
+		if (part_hop_done || wrapper_hop_done)
+			goto out_free_backup_vhdr;
 		if (hfs_part_find(sb, &part_start, &part_size))
 			goto out_free_backup_vhdr;
+		part_hop_done = true;
 		goto reread;
 	}
 
-- 
2.55.0

Re: [PATCH 1/2] hfs: bound the partition-table hop in hfs_mdb_get()

[Viacheslav Dubeyko]

On Sat, 2026-09-26 at 16:40 +0800, Matthias Goergens wrote:
> hfs_mdb_get() loops "while (1)" around hfs_part_find(), rereading the
> volume header wherever the partition table points.  A partition entry
> with a zero start (pdStart or pmPyPartStart) leaves part_start where
> it
> was, and the loop reads the same blocks forever.
> 
> An Apple partition map sits at the start of the raw device: the boot
> ROM
> reads it from block 1 (TN1189), and nothing Apple documents nests one
> inside a partition.  Follow at most one partition-table hop and fail
> with -EIO after that, as for a table that cannot be parsed.  A zero
> start is caught on the second pass, when the loop comes round again.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
> ---
> A partition entry pointing at its own table hangs the mount forever
> without this patch and fails at once with it:
> 
>   img=hfs-partmap-loop.img
>   put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc
> status=none; }
>   truncate --size=64K $img
>   put $((512+0x00)) '\x50\x4d'          # pmSig 'PM'
>   put $((512+0x04)) '\x00\x00\x00\x01'  # pmMapBlkCnt 1
>   put $((512+0x08)) '\x00\x00\x00\x00'  # pmPyPartStart 0 (self)
>   put $((512+0x0c)) '\x00\x00\x00\x64'  # pmPartBlkCnt 100
>   put $((512+0x30)) 'Apple_HFS'         # pmPartType
>   mount -o ro,loop -t hfs $img /mnt
> ---
>  fs/hfs/mdb.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
> index 277de712f9d4..1704f332e28d 100644
> --- a/fs/hfs/mdb.c
> +++ b/fs/hfs/mdb.c
> @@ -134,6 +134,7 @@ int hfs_mdb_get(struct super_block *sb)
>  	sector_t part_start, part_size;
>  	loff_t off;
>  	__be16 attrib;
> +	bool part_hop_done = false;
>  
>  	/* set the device driver to 512-byte blocks */
>  	size = sb_min_blocksize(sb, HFS_SECTOR_SIZE);
> @@ -152,11 +153,18 @@ int hfs_mdb_get(struct super_block *sb)
>  			break;
>  		brelse(bh);
>  
> -		/* check for a partition block
> +		/*
> +		 * check for a partition block
>  		 * (should do this only for cdrom/loop though)
> +		 *
> +		 * The partition map is at the start of the device:
> follow
> +		 * it once, or an entry pointing at itself loops
> forever.
>  		 */
> +		if (part_hop_done)
> +			return -EIO;
>  		if (hfs_part_find(sb, &part_start, &part_size))

If I understood the problem correctly, then we  have issue in
hfs_part_find(). This method should have the proper sanity check.

Thanks,
Slava.

>  			return -EIO;
> +		part_hop_done = true;
>  	}
>  
>  	HFS_SB(sb)->alloc_blksz = size = be32_to_cpu(mdb-
> >drAlBlkSiz);
> 
> base-commit: 6812ce4e4379ffc99c52401ec28f0d7ffbc36206

Re: [PATCH 2/2] hfsplus: bound the wrapper and partition-table hops in hfsplus_read_wrapper()

[Viacheslav Dubeyko]

On Sat, 2026-09-26 at 16:40 +0800, Matthias Goergens wrote:
> hfsplus_read_wrapper() rereads the volume header through a bare "goto
> reread", following an HFS wrapper's embedded-volume descriptor or, if
> the header matches neither signature, the partition-table fallback it
> shares with hfs, with no bound on either.  A descriptor or partition
> entry with a zero offset leaves part_start where it was, and the
> mount
> loops forever.
> 
> TN1150 ("HFS Plus Volume Format") requires a wrapper's embedded
> volume
> to be HFS Plus: "When an HFS Plus volume is embedded, drEmbedSigWord
> must be kHFSPlusSigWord ('H+')".  So there is at most one wrapper
> hop,
> and Apple's hfs code, GRUB and 7-Zip all follow it once.  A partition
> map sits at the start of the raw device (previous patch), so a
> partition-table hop only makes sense before any wrapper hop.  Allow
> one
> of each, in that order, and fail with -EINVAL otherwise.  A zero
> offset
> is caught on the second pass.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
> ---
> A wrapper whose embedded-volume descriptor points back at itself
> hangs the mount forever without this patch and fails at once with it:
> 
>   img=hfsplus-wrapper-loop.img
>   put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc
> status=none; }
>   truncate --size=64K $img
>   put $((1024 + 0x00)) '\x42\x44'          # drSigWord 'BD'
>   put $((1024 + 0x0a)) '\x82\x00'          # drAtrb: SLOCK | SPARED
>   put $((1024 + 0x14)) '\x00\x00\x02\x00'  # drAlBlkSiz 512
>   put $((1024 + 0x7c)) '\x48\x2b'          # drEmbedSigWord 'H+'
>   put $((1024 + 0x7e)) '\x00\x00\x00\x64'  # drEmbedExtent: start 0,
> count 100
>   mount -o ro,loop -t hfsplus $img /mnt
> 
> The same partition-table entry as the hfs patch hangs an hfsplus
> mount
> the same way:
> 
>   img=hfsplus-partmap-loop.img
>   put() { printf "$2" | dd of=$img bs=1 seek=$1 conv=notrunc
> status=none; }
>   truncate --size=64K $img
>   put $((512+0x00)) '\x50\x4d'          # pmSig 'PM'
>   put $((512+0x04)) '\x00\x00\x00\x01'  # pmMapBlkCnt 1
>   put $((512+0x08)) '\x00\x00\x00\x00'  # pmPyPartStart 0 (self)
>   put $((512+0x0c)) '\x00\x00\x00\x64'  # pmPartBlkCnt 100
>   put $((512+0x30)) 'Apple_HFS'         # pmPartType
>   mount -o ro,loop -t hfsplus $img /mnt
> ---
>  fs/hfsplus/wrapper.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
> index 30cf4fe78b3d..df8079a4d8f5 100644
> --- a/fs/hfsplus/wrapper.c
> +++ b/fs/hfsplus/wrapper.c
> @@ -137,6 +137,7 @@ int hfsplus_read_wrapper(struct super_block *sb)
>  	struct hfsplus_wd wd;
>  	sector_t part_start, part_size;
>  	u32 blocksize;
> +	bool part_hop_done = false, wrapper_hop_done = false;
>  	int error = 0;
>  
>  	error = -EINVAL;
> @@ -172,21 +173,35 @@ int hfsplus_read_wrapper(struct super_block
> *sb)
>  	case cpu_to_be16(HFSPLUS_VOLHEAD_SIG):
>  		break;
>  	case cpu_to_be16(HFSP_WRAP_MAGIC):
> +		/*
> +		 * The embedded volume must be HFS Plus (TN1150), so
> a
> +		 * second wrapper is corrupt; a descriptor pointing
> at
> +		 * itself would otherwise loop forever.
> +		 */
> +		if (wrapper_hop_done)
> +			goto out_free_backup_vhdr;
>  		if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))

Ditto. We need to have a proper sanity check in hfsplus_read_mdb().

>  			goto out_free_backup_vhdr;
>  		wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
>  		part_start += (sector_t)wd.ablk_start +
>  			       (sector_t)wd.embed_start *
> wd.ablk_size;
>  		part_size = (sector_t)wd.embed_count * wd.ablk_size;
> +		wrapper_hop_done = true;
>  		goto reread;
>  	default:
>  		/*
>  		 * Check for a partition block.
>  		 *
>  		 * (should do this only for cdrom/loop though)
> +		 *
> +		 * The partition map is at the start of the device:
> follow
> +		 * it at most once, and not from inside a wrapper.
>  		 */
> +		if (part_hop_done || wrapper_hop_done)
> +			goto out_free_backup_vhdr;
>  		if (hfs_part_find(sb, &part_start, &part_size))

Ditto. We need to have a proper sanity check in hfs_part_find().

Thanks,
Slava.

>  			goto out_free_backup_vhdr;
> +		part_hop_done = true;
>  		goto reread;
>  	}
>