Skip to content

hfsplus: fix xattr entrylength OOB read and NULL hidden_dir on R/W remount - #2626

Closed
vfsci-bot[bot] wants to merge 1 commit into
vfs.base.cifrom
pw/1169472/vfs.base.ci
Closed

vfsci-bot[bot] wants to merge 1 commit into
vfs.base.cifrom
pw/1169472/vfs.base.ci

Conversation

@vfsci-bot

@vfsci-bot vfsci-bot Bot commented Sep 20, 2026

Copy link
Copy Markdown

Series: https://patchwork.kernel.org/project/linux-fsdevel/list/?series=1169472
Submitter: Hui Peng
Version: 1
Patches: 1/1
Message-ID: <20260919222603.3794265-1-benquike@gmail.com>
Base: vfs.base.ci
Lore: https://lore.kernel.org/linux-fsdevel/20260919222603.3794265-1-benquike@gmail.com


Automated by ml2pr

…mount

Fix three issues in fs/hfsplus/:

1. In __hfsplus_getxattr() (fs/hfsplus/xattr.c), verify that
   record_length and attr_size fit within fd.entrylength before copying
   from the catalog or attributes btree entry so a malformed attribute
   length cannot trigger a slab-out-of-bounds read or leak uninitialized
   slab memory.
2. In hfsplus_delete_all_attrs() (fs/hfsplus/attributes.c), return early
   if HFSPLUS_SB(sb)->attr_tree is NULL.
3. In hfsplus_reconfigure() and hfsplus_unlink() (fs/hfsplus/super.c,
   fs/hfsplus/dir.c), allocate hidden_dir when remounting from read-only
   to read-write and guard against NULL hidden_dir when unlinking open
   files.

Fixes: 127e5f5 ("hfsplus: rework functionality of getting, setting and deleting of extended attributes")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
@vfsci-bot

vfsci-bot Bot commented Oct 4, 2026

Copy link
Copy Markdown
Author

This PR is older than 14 days. Closing automatically. If the series is still relevant, a new version will create a new PR.


Automated by ml2pr

@vfsci-bot vfsci-bot Bot closed this Oct 4, 2026
@vfsci-bot
vfsci-bot Bot deleted the pw/1169472/vfs.base.ci branch October 4, 2026 05:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant