On 2025/07/08 4:03, Viacheslav Dubeyko wrote: >>> @@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct > super_block *sb) >>> return PTR_ERR(attr_file); >>> } >>> >>> - BUG_ON(i_size_read(attr_file) != 0); > > But I still worry about i_size_read(attr_file). How this size could be not zero > during hfsplus_create_attributes_file() call? Because the filesystem image is intentionally crafted. syzkaller mounts this image which already contains inode for xattr file but vhdr->attr_file.total_blocks at https://elixir.bootlin.com/linux/v6.16-rc5/source/fs/hfsplus/super.c#L485 is 0. This inconsistency is not detected during mount operation, and sbi->attr_tree_state remains HFSPLUS_EMPTY_ATTR_TREE, and this inconsistency is detected when setxattr operation is called. The correct fix might be to implement stricter consistency check during mount operation, but even userspace fsck.hfsplus is not doing such check.
