Re: [PATCH v7] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw

[Joas Antonio dos Santos]

On Fri, 17 Jul 2026 19:27:06 +0530, Deepanshu Kartikey wrote:
> hfsplus_reconfigure() does not create the hidden directory when
> remounting from read-only to read-write, leaving sbi->hidden_dir
> as NULL.

I independently reproduced the syzbot null-ptr-deref and confirm the
root cause: on a read-only mount of a volume whose on-disk "HFS+ Private
Data" directory is absent, sbi->hidden_dir stays NULL (it is created
only in hfsplus_fill_super() under !sb_rdonly). After a remount,rw,
hfsplus_unlink() -> hfsplus_cat_write_inode(sbi->hidden_dir) dereferences
the NULL inode (inode->i_sb) during rename -- the reported crash in the
[0x28-0x2f] range.

I applied v7 on c339f4010 and tested on arm64 with KASAN, using the
crafted image from the syzbot reproducer and the equivalent sequence
(mount -o ro -> mount -o remount,rw -> rename): without the patch this
oopses in hfsplus_cat_write_inode; with v7 the remount,rw creates the
hidden directory, the rename succeeds, and the KASAN splat is gone. A
normal read-write mount + rename is unaffected.

Tested-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>

Thanks,
Joas