Re: [PATCH] hfs: return error when bnode already hashed in hfs_bnode_create

[Viacheslav Dubeyko]

On Fri, 2026-04-17 at 18:59 +0000, Tristan Madani wrote:
> hfs_bnode_create() checks if the requested node number is already
> present in the B-tree hash table.  If it is, the function emits a
> WARN_ON(1) and returns the existing node:
> 
>     if (node) {
>         pr_crit("new node %u already hashed?\n", num);
>         WARN_ON(1);
>         return node;
>     }
> 
> On crafted HFS images with inconsistent B-tree bitmap data, the
> allocator can repeatedly request creation of node 0 which is
> already hashed, triggering this WARNING reliably on every mkdir.
> 
> Replace the WARN_ON with an error return.  The node being already
> hashed when creation is requested indicates filesystem corruption
> -- returning ERR_PTR(-EIO) allows the caller to handle this
> gracefully rather than generating a kernel stack trace.
> 
> Reported-by: syzbot+a19ca73b21fe8bc69101@xxxxxxxxxxxxxxxxxxxxxxxxx
> Tested-by: syzbot+a19ca73b21fe8bc69101@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=a19ca73b21fe8bc69101
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  fs/hfs/bnode.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
> index e8cd1a31f247..69895ccf81ef 100644
> --- a/fs/hfs/bnode.c
> +++ b/fs/hfs/bnode.c
> @@ -517,8 +517,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
>  	spin_unlock(&tree->hash_lock);
>  	if (node) {
>  		pr_crit("new node %u already hashed?\n", num);
> -		WARN_ON(1);
> -		return node;
> +		return ERR_PTR(-EIO);

We return -EEXISTS in HFS+ because it is the case of node existence [1].

This issue takes place because of node 0 has been set in bitmap as not
available. However, every HFS/HFS+ b-tree must have this node. We already
implemented this check for HFS+. I would like to ask you to port this check for
the case of HFS [2].

Thanks,
Slava.

>  	}
>  	node = __hfs_bnode_create(tree, num);
>  	if (!node)

[1]
https://lore.kernel.org/linux-fsdevel/08e7f7ef7da57448945a8d62160d2d7a67df2883.camel@xxxxxxx/
[2]
https://lore.kernel.org/linux-fsdevel/43be87e694ed6fe291990226624559e7f01820d9.camel@xxxxxxxxxxx/