Re: BUG: unable to handle kernel paging request in __hfsplus_brec_find

From: dave mad maxXx

Date: Thu Sep 24 2026 - 14:53:06 EST


Hi,

I am following up on this HFS+ crash with additional diagnostic-only results.

I recovered the 25-call syzkaller program byte-for-byte from the
published console log (6553 bytes; SHA-256
c0638cfd888ce9e61abd5d82ab9afeba058d3b42940b2ab8469d12c4f17abe7e) and
ran it against the matching investigation environment without fault
injection.

The natural runs reach the relevant post-split hfs_bnode_find() path,
but do not reproduce the historical failure. In the current passive
trace, node 3 is created and inserted into the hash, and 45 observed
lookups return it with error=0. No ERR_PTR(-EIO) or target crash is
observed.

The published machine disk image does not appear to preserve the HFS+
filesystem state at the instant of the crash, so I cannot yet
determine the first divergence between the healthy run and the
historical -EIO path.

If available, could you please provide either:

1. the HFS+ filesystem image/state mounted when this crash occurred; or
2. any pre-crash trace/log around hfs_bnode_find() that identifies the
node and the condition that caused -EIO; or
3. any additional execution artifact that preserves the HFS+ B-tree
state immediately before the fault?

This is only a request for missing diagnostic evidence; I am not
claiming that the original crash has been reproduced or that its
natural root cause has been established.

Thanks,
David Maximiliano Hermitte