Re: [PATCH] hfs: validate drAlBlkSiz and fs_ablocks in hfs_mdb_get()

[Viacheslav Dubeyko]

On Sat, 2026-09-19 at 22:26 +0000, Hui Peng wrote:
> In hfs_mdb_get() (fs/hfs/mdb.c), reject images with allocation block
> size (drAlBlkSiz) of 0 or not a multiple of HFS_SECTOR_SIZE (512), or
> with fs_ablocks == 0, preventing a divide-by-zero trap and out-of-
> bounds
> bitmap scans on crafted HFS images.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
> index 277de712f9d4..9e78c561a3f1 100644
> --- a/fs/hfs/mdb.c
> +++ b/fs/hfs/mdb.c
> @@ -204,6 +204,11 @@ int hfs_mdb_get(struct super_block *sb)
>  	/* These parameters are read from the MDB, and never written
> */
>  	HFS_SB(sb)->part_start = part_start;
>  	HFS_SB(sb)->fs_ablocks = be16_to_cpu(mdb->drNmAlBlks);
> +	if (!HFS_SB(sb)->fs_ablocks) {

This check doesn't look like checking that it's "not a multiple of
HFS_SECTOR_SIZE (512)". Could you make your check more accurate?

Also, if you started this check, then let's check that all these fields
are consistent:

	__be16 drNmAlBlks;		/* number of allocation blocks
*/
	__be32 drAlBlkSiz;		/* bytes in an allocation
block */

	__be16 drFreeBks;		/* number of free allocation
blocks */

Could you please add these checks?

Thanks,
Slava.

> +		brelse(bh);
> +		HFS_SB(sb)->mdb_bh = NULL;
> +		return -EINVAL;
> +	}
>  	HFS_SB(sb)->fs_div = HFS_SB(sb)->alloc_blksz >> sb-
> >s_blocksize_bits;
>  	HFS_SB(sb)->clumpablks = be32_to_cpu(mdb->drClpSiz) /
>  				 HFS_SB(sb)->alloc_blksz;