Re: [PATCH] hfsplus: fix truncated xattr names in listxattr()

[Viacheslav Dubeyko]

On Fri, 2026-08-28 at 15:38 +0200, Maurycy Pawlowski-Wieronski via B4
Relay wrote:
> From: Maurycy Pawlowski-Wieronski <maurycy@xxxxxxxxxxx>
> 
> Commit 7dcbf17e3f91 ("hfsplus: refactor copy_name to not use
> strncpy")
> changed copy_name() to build names in the osx. namespace with
> scnprintf().
> 
> The supplied buffer size includes room for the prefix and the name,
> but
> not for the terminating NUL:
> 
>   $ python3 -c "import os; print(os.listxattr('/mnt/tm/.DS_Store'))"
>   ['osx.com.apple.FinderInf']
> 
> The truncated names cannot be passed back to getxattr(), so getfattr
> -d,
> rsync -X, cp --preserve=xattr and tar --xattrs etc. seem to lose all
> Apple attributes on hfsplus volumes.
> 
> Names in other namespaces go through the strscpy() branch, which
> already
> sizes the buffer correctly. That's `why xfstests generic/377 does not
> catch it.

Do you mean that you can reproduce some issue for generic/377? I don't
see any issues with this test-case.

> 
> Fixes: 7dcbf17e3f91 ("hfsplus: refactor copy_name to not use
> strncpy")
> Cc: stable@xxxxxxxxxxxxxxx # v6.10+
> Signed-off-by: Maurycy Pawlowski-Wieronski <maurycy@xxxxxxxxxxx>
> ---
>  fs/hfsplus/xattr.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
> index 21a1c196c71f..4a3c97373682 100644
> --- a/fs/hfsplus/xattr.c
> +++ b/fs/hfsplus/xattr.c
> @@ -515,8 +515,8 @@ static ssize_t copy_name(char *buffer, const char
> *xattr_name, size_t name_len)
>  	memset(buffer, 0, name_len);
>  
>  	if (!is_known_namespace(xattr_name)) {
> -		len = scnprintf(buffer, name_len +
> XATTR_MAC_OSX_PREFIX_LEN,
> -				 "%s%s", XATTR_MAC_OSX_PREFIX,
> xattr_name);
> +		len = scnprintf(buffer, name_len +
> XATTR_MAC_OSX_PREFIX_LEN + 1,
> +				"%s%s", XATTR_MAC_OSX_PREFIX,
> xattr_name);

I don't quite follow how this could solve anything. If we have enough
buffer size that was defined by caller, then this buffer should be
zeroed and NUL is already there. If we have not enough buffer size,
then we write out of available memory. Could you please explain your
fix? Have you tested the fix by running all xfstests?

Thanks,
Slava.

>  	} else {
>  		len = strscpy(buffer, xattr_name, name_len + 1);
>  		if (len < 0) {
> 
> ---
> base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
> change-id: 20260828-hfsplus-copy_name-fix-a6e2a0a4485e
> 
> Best regards,
> --  
> Maurycy Pawlowski-Wieronski <maurycy@xxxxxxxxxxx>
>