On 2025/07/31 4:24, Viacheslav Dubeyko wrote: > If we considering case HFS_CDR_DIR in hfs_read_inode(), then we know that it > could be HFS_POR_CNID, HFS_ROOT_CNID, or >= HFS_FIRSTUSER_CNID. Do you mean that > HFS_POR_CNID could be a problem in hfs_write_inode()? Yes. Passing one of 1, 5 or 15 instead of 2 from hfs_fill_super() triggers BUG() in hfs_write_inode(). We *MUST* validate at hfs_fill_super(), or hfs_read_inode() shall have to also reject 1, 5 and 15 (and as a result only accept 2).
