On 2025/07/26 7:25, Tetsuo Handa wrote: > On 2025/07/26 2:45, Viacheslav Dubeyko wrote: >> If we manage the inode IDs properly in hfs_read_inode(), then hfs_write_inode() >> never will receive the invalid inode ID. I don't see the point to remove the >> BUG() in hfs_write_inode(). > > As long as we don't check that rec.dir.DirID is HFS_ROOT_CNID at hfs_fill_super(), > hfs_write_inode() shall receive the invalid inode ID upon unmount operation. > Here is the steps to confirm. $ wget -O hfs.c 'https://syzkaller.appspot.com/text?tag=ReproC&x=111450f0580000' $ patch -lp1 << "EOF" --- a/hfs.c +++ b/hfs.c @@ -34,6 +34,7 @@ #endif static unsigned long long procid; +static unsigned int dirid; static void sleep_ms(uint64_t ms) { @@ -437,6 +438,7 @@ goto error_close_loop; } } + pwrite(memfd, &dirid, sizeof(dirid), 4096 + 548); close(memfd); *loopfd_p = loopfd; return 0; @@ -669,8 +671,10 @@ syz_mount_image(/*fs=*/0, /*dir=*/0x200000002080, /*flags=*/0, /*opts=*/0, /*chdir=*/0, /*size=*/0, /*img=*/0); } -int main(void) +int main(int argc, char *argv[]) { + if (argc == 2) + dirid = (atoi(argv[1]) & 15) * 0x1000000; syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); EOF $ gcc -Wall -O2 -o hfs hfs.c # timeout 1 unshare -m ./hfs 1
