Re: [PATCH v3] hfs: remove BUG() from hfs_release_folio()/hfs_test_inode()/hfs_write_inode()

[Tetsuo Handa]

On 2025/07/26 7:25, Tetsuo Handa wrote:
> On 2025/07/26 2:45, Viacheslav Dubeyko wrote:
>> If we manage the inode IDs properly in hfs_read_inode(), then hfs_write_inode()
>> never will receive the invalid inode ID. I don't see the point to remove the
>> BUG() in hfs_write_inode().
> 
> As long as we don't check that rec.dir.DirID is HFS_ROOT_CNID at hfs_fill_super(), 
> hfs_write_inode() shall receive the invalid inode ID upon unmount operation.
> 

Here is the steps to confirm.

$ wget -O hfs.c 'https://syzkaller.appspot.com/text?tag=ReproC&x=111450f0580000'
$ patch -lp1 << "EOF"
--- a/hfs.c
+++ b/hfs.c
@@ -34,6 +34,7 @@
 #endif

 static unsigned long long procid;
+static unsigned int dirid;

 static void sleep_ms(uint64_t ms)
 {
@@ -437,6 +438,7 @@
       goto error_close_loop;
     }
   }
+  pwrite(memfd, &dirid, sizeof(dirid), 4096 + 548);
   close(memfd);
   *loopfd_p = loopfd;
   return 0;
@@ -669,8 +671,10 @@
   syz_mount_image(/*fs=*/0, /*dir=*/0x200000002080, /*flags=*/0, /*opts=*/0,
                   /*chdir=*/0, /*size=*/0, /*img=*/0);
 }
-int main(void)
+int main(int argc, char *argv[])
 {
+  if (argc == 2)
+    dirid = (atoi(argv[1]) & 15) * 0x1000000;
   syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
           /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
           /*fd=*/(intptr_t)-1, /*offset=*/0ul);
EOF
$ gcc -Wall -O2 -o hfs hfs.c
# timeout 1 unshare -m ./hfs 1