Leo Stone b905bafdea hfs: Sanity check the root record ... In the syzbot reproducer, the hfs_cat_rec for the root dir has type HFS_CDR_FIL after being read with hfs_bnode_read() in hfs_super_fill(). This indicates it should be used as an hfs_cat_file, which is 102 bytes. Only the first 70 bytes of that struct are initialized, however, because the entrylength passed into hfs_bnode_read() is still the length of a directory record. This causes uninitialized values to be used later on, when the hfs_cat_rec union is treated as the larger hfs_cat_file struct. Add a check to make sure the retrieved record has the correct type for the root directory (HFS_CDR_DIR), and make sure we load the correct number of bytes for a directory record. Reported-by: syzbot+2db3c7526ba68f4ea776@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2db3c7526ba68f4ea776 Tested-by: syzbot+2db3c7526ba68f4ea776@syzkaller.appspotmail.com Tested-by: Leo Stone <leocstone@gmail.com> Signed-off-by: Leo Stone <leocstone@gmail.com> Link: https://lore.kernel.org/r/20241201051420.77858-1-leocstone@gmail.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org>		2024-12-02 15:32:19 +01:00
..
attr.c
bfind.c
bitmap.c
bnode.c
brec.c
btree.c
btree.h
catalog.c
dir.c
extent.c	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
hfs.h
hfs_fs.h	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
inode.c	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
Kconfig
Makefile
mdb.c
part_tbl.c
string.c
super.c	hfs: Sanity check the root record	2024-12-02 15:32:19 +01:00
sysdep.c
trans.c