On Thu, 2025-07-24 at 23:08 +0800, Edward Adam Davis wrote: > If the number of entries in the bnode is 0, the bnode is considered > invalid. > > Reported-by: syzbot+41ba9c82bce8d7101765@xxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://syzkaller.appspot.com/bug?extid=41ba9c82bce8d7101765 > Tested-by: syzbot+41ba9c82bce8d7101765@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> > --- > fs/hfs/bfind.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c > index ef9498a6e88a..1d6f2bbafa7a 100644 > --- a/fs/hfs/bfind.c > +++ b/fs/hfs/bfind.c > @@ -133,6 +133,8 @@ int hfs_brec_find(struct hfs_find_data *fd) > goto invalid; > if (bnode->type != (--height ? HFS_NODE_INDEX : HFS_NODE_LEAF)) > goto invalid; > + if (!bnode->num_recs) > + goto invalid; If b-tree node hasn't records, then it doesn't mean that it's invalid. Because, if we go into invalid way, then we show the message that node is corrupted [1]: invalid: pr_err("inconsistency in B*Tree (%d,%d,%d,%u,%u)\n", height, bnode->height, bnode->type, nidx, parent); res = -EIO; But it is not true because the node simply has no records. It could be invalid if bnode->num_recs < 0. Also, I've sent the patch [2] already. I believe it should fix the issue. Am I wrong here? Thanks, Slava. [1] https://elixir.bootlin.com/linux/v6.16-rc6/source/fs/hfs/bfind.c#L152 [2] https://lore.kernel.org/linux-fsdevel/20250703214912.244138-1-slava@xxxxxxxxxxx/ > bnode->parent = parent; > > res = __hfs_brec_find(bnode, fd);
