Re: [PATCH v3] hfs: Validate CNIDs in hfs_read_inode
From: kernel test robot
Date: Tue Mar 10 2026 - 11:29:41 EST
Hi George,
kernel test robot noticed the following build warnings:
[auto build test WARNING on brauner-vfs/vfs.all]
[also build test WARNING on linus/master v7.0-rc3 next-20260309]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/George-Anthony-Vernon/hfs-Validate-CNIDs-in-hfs_read_inode/20260310-081836
base: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.all
patch link: https://lore.kernel.org/r/20260310000826.242674-1-contact%40gvernon.com
patch subject: [PATCH v3] hfs: Validate CNIDs in hfs_read_inode
config: microblaze-randconfig-r132-20260310 (https://download.01.org/0day-ci/archive/20260310/202603102229.zVuUXq6v-lkp@xxxxxxxxx/config)
compiler: microblaze-linux-gcc (GCC) 9.5.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260310/202603102229.zVuUXq6v-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603102229.zVuUXq6v-lkp@xxxxxxxxx/
sparse warnings: (new ones prefixed by >>)
>> fs/hfs/inode.c:408:55: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] cnid @@ got restricted __be32 [usertype] FlNum @@
fs/hfs/inode.c:408:55: sparse: expected unsigned int [usertype] cnid
fs/hfs/inode.c:408:55: sparse: got restricted __be32 [usertype] FlNum
>> fs/hfs/inode.c:431:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] cnid @@ got restricted __be32 [usertype] DirID @@
fs/hfs/inode.c:431:54: sparse: expected unsigned int [usertype] cnid
fs/hfs/inode.c:431:54: sparse: got restricted __be32 [usertype] DirID
vim +408 fs/hfs/inode.c
378
379 /*
380 * hfs_read_inode
381 */
382 static int hfs_read_inode(struct inode *inode, void *data)
383 {
384 struct hfs_iget_data *idata = data;
385 struct hfs_sb_info *hsb = HFS_SB(inode->i_sb);
386 hfs_cat_rec *rec;
387
388 HFS_I(inode)->flags = 0;
389 HFS_I(inode)->rsrc_inode = NULL;
390 mutex_init(&HFS_I(inode)->extents_lock);
391 INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
392 spin_lock_init(&HFS_I(inode)->open_dir_lock);
393
394 /* Initialize the inode */
395 inode->i_uid = hsb->s_uid;
396 inode->i_gid = hsb->s_gid;
397 set_nlink(inode, 1);
398
399 if (idata->key)
400 HFS_I(inode)->cat_key = *idata->key;
401 else
402 HFS_I(inode)->flags |= HFS_FLG_RSRC;
403 HFS_I(inode)->tz_secondswest = sys_tz.tz_minuteswest * 60;
404
405 rec = idata->rec;
406 switch (rec->type) {
407 case HFS_CDR_FIL:
> 408 if (!is_valid_catalog_record(rec->file.FlNum, HFS_CDR_FIL))
409 goto make_bad_inode;
410 if (!HFS_IS_RSRC(inode)) {
411 hfs_inode_read_fork(inode, rec->file.ExtRec, rec->file.LgLen,
412 rec->file.PyLen, be16_to_cpu(rec->file.ClpSize));
413 } else {
414 hfs_inode_read_fork(inode, rec->file.RExtRec, rec->file.RLgLen,
415 rec->file.RPyLen, be16_to_cpu(rec->file.ClpSize));
416 }
417
418 inode->i_ino = be32_to_cpu(rec->file.FlNum);
419 inode->i_mode = S_IRUGO | S_IXUGO;
420 if (!(rec->file.Flags & HFS_FIL_LOCK))
421 inode->i_mode |= S_IWUGO;
422 inode->i_mode &= ~hsb->s_file_umask;
423 inode->i_mode |= S_IFREG;
424 inode_set_mtime_to_ts(inode,
425 inode_set_atime_to_ts(inode, inode_set_ctime_to_ts(inode, hfs_m_to_utime(rec->file.MdDat))));
426 inode->i_op = &hfs_file_inode_operations;
427 inode->i_fop = &hfs_file_operations;
428 inode->i_mapping->a_ops = &hfs_aops;
429 break;
430 case HFS_CDR_DIR:
> 431 if (!is_valid_catalog_record(rec->dir.DirID, HFS_CDR_DIR))
432 goto make_bad_inode;
433 inode->i_ino = be32_to_cpu(rec->dir.DirID);
434 inode->i_size = be16_to_cpu(rec->dir.Val) + 2;
435 HFS_I(inode)->fs_blocks = 0;
436 inode->i_mode = S_IFDIR | (S_IRWXUGO & ~hsb->s_dir_umask);
437 inode_set_mtime_to_ts(inode,
438 inode_set_atime_to_ts(inode, inode_set_ctime_to_ts(inode, hfs_m_to_utime(rec->dir.MdDat))));
439 inode->i_op = &hfs_dir_inode_operations;
440 inode->i_fop = &hfs_dir_operations;
441 break;
442 make_bad_inode:
443 pr_warn("Invalid cnid %lu\n", inode->i_ino);
444 pr_warn("Volume is probably corrupted, try performing fsck.\n");
445 fallthrough;
446 default:
447 make_bad_inode(inode);
448 break;
449 }
450 return 0;
451 }
452
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki