Re: [PATCH] hfs: validate catalog CNIDs before instantiating inodes

[Tetsuo Handa]

Sashiko has some comments on this patch:
https://sashiko.dev/#/patchset/20260702183800.1119202-1-davemadmaxxx%40gmail.com

On 2026/07/03 3:38, David Maximiliano Hermitte wrote:
> hfs_cat_find_brec() first resolves a catalog thread record by CNID and
> then looks up the corresponding catalog record by parent/name. On a
> corrupted filesystem image, the second lookup may find a record whose
> CNID does not match the CNID that was requested.
> 
> Validate the catalog record found by the second lookup before returning
> it to callers. Inspect the already-found record with hfs_bnode_read(),
> not hfs_brec_read(), and reject records whose CNID is invalid for their
> record type or does not match the requested CNID.
> 
> Also validate CNIDs in hfs_read_inode() before the inode is populated,
> and propagate hfs_read_inode() errors from the resource-fork lookup path.
> For the root inode path, require the root catalog record to be a directory
> with DirID == HFS_ROOT_CNID, and drop the root inode reference if it was
> instantiated as a bad inode.
> 
> This keeps hfs_write_inode() unchanged and prevents corrupted catalog
> records from reaching the existing reserved-CNID BUG() path during
> writeback.
> 
> Reported-by: syzbot+97e301b4b82ae803d21b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=97e301b4b82ae803d21b
> Cc: George Anthony Vernon <contact@xxxxxxxxxxx>
> Cc: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: David Maximiliano Hermitte <davemadmaxxx@xxxxxxxxx>
> ---
>  fs/hfs/catalog.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
>  fs/hfs/hfs_fs.h  | 19 +++++++++++++++++++
>  fs/hfs/inode.c   |  9 ++++++++-
>  fs/hfs/super.c   |  8 +++++++-
>  4 files changed, 81 insertions(+), 3 deletions(-)