Re: [PATCH] hfs/hfsplus: serialize B-tree close against folio release

[Viacheslav Dubeyko]

On Fri, 2026-09-18 at 15:08 +0200, Bruno Produit wrote:
> From: Kyle Zeng <kylebot@xxxxxxxxxx>
> 
> From: Kyle Zeng <kylebot@xxxxxxxxxx>

Why do we have the same email two times here? :)

> 
> B-tree nodes with a zero reference count remain in the node hash
> until
> folio reclaim or tree teardown frees them.  The folio release
> callbacks
> remove nodes while holding hash_lock, but hfs_btree_close() walks and
> frees the same hash without that lock.  Reclaim can therefore unhash
> and
> free a node after close has loaded its pointer, causing a use-after-
> free
> or double-free.
> 
> Detach each node with hfs_bnode_unhash() while holding hash_lock
> before
> inspecting and freeing it.  Drop the lock before hfs_bnode_free() so
> a
> large tree is not freed while holding a spinlock.  Apply the same fix
> to
> the matching HFS+ implementation.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

I think we need to have Cc: stable@xxxxxxxxxxxxxxx here too.

> Reported-by: syzbot+d729df28d933979e017a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
> Reported-by: syzbot+2eac7d175baf21e6a5d5@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
> Reported-by: syzbot+7155b2fe09e033c91381@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
> Reported-by: syzbot+adeb387cede15eb11607@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
> Reported-by: syzbot+ae7f2423f3648100506d@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d

Does this fix really eliminates these reported issues? Have you tested
all of these cases? It will be great to have this clarification in the
commit message.

> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> Signed-off-by: Bruno Produit <bruno.produit@xxxxxxxxxxxxxxx>
> ---
>  fs/hfs/btree.c     | 11 ++++++++---
>  fs/hfsplus/btree.c | 11 ++++++++---
>  2 files changed, 16 insertions(+), 6 deletions(-)
> 
> diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
> index 41b4e8fc9..d85a1df9f 100644
> --- a/fs/hfs/btree.c
> +++ b/fs/hfs/btree.c
> @@ -310,14 +310,19 @@ void hfs_btree_close(struct hfs_btree *tree)
>  		return;
>  
>  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> -		while ((node = tree->node_hash[i])) {
> -			tree->node_hash[i] = node->next_hash;
> +		for (;;) {

I really dislike this infinite loop pattern. Could we have a loop is
limited by some value?

> +			spin_lock(&tree->hash_lock);
> +			node = tree->node_hash[i];
> +			if (node)
> +				hfs_bnode_unhash(node);
> +			spin_unlock(&tree->hash_lock);
> +			if (!node)
> +				break;
>  			if (atomic_read(&node->refcnt))
>  				pr_err("node %d:%d still has %d
> user(s)!\n",
>  				       node->tree->cnid, node->this,
>  				       atomic_read(&node->refcnt));
>  			hfs_bnode_free(node);
> -			tree->node_hash_cnt--;
>  		}
>  	}
>  	iput(tree->inode);
> diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
> index 2ea8cd565..a90c9f416 100644
> --- a/fs/hfsplus/btree.c
> +++ b/fs/hfsplus/btree.c
> @@ -417,15 +417,20 @@ void hfs_btree_close(struct hfs_btree *tree)
>  		return;
>  
>  	for (i = 0; i < NODE_HASH_SIZE; i++) {
> -		while ((node = tree->node_hash[i])) {
> -			tree->node_hash[i] = node->next_hash;
> +		for (;;) {

Ditto.

Thanks,
Slava.

> +			spin_lock(&tree->hash_lock);
> +			node = tree->node_hash[i];
> +			if (node)
> +				hfs_bnode_unhash(node);
> +			spin_unlock(&tree->hash_lock);
> +			if (!node)
> +				break;
>  			if (atomic_read(&node->refcnt))
>  				pr_crit("node %d:%d "
>  						"still has %d
> user(s)!\n",
>  					node->tree->cnid, node-
> >this,
>  					atomic_read(&node->refcnt));
>  			hfs_bnode_free(node);
> -			tree->node_hash_cnt--;
>  		}
>  	}
>  	iput(tree->inode);