Merge tag 'hfs-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs

Pull HFS updates from Viacheslav Dubeyko:
 "This contains several fixes in HFS/HFS+ of syzbot reported issues and
  HFS/HFS+ fixes of xfstests failures.

   - b-tree bitmap corruption check (Aditya Prakash Srivastava)

     During b-tree open (hfs_btree_open()), the code verifies that the
     allocation map bit for the tree header (node 0) is set. If not, it
     indicates a corrupted map record/bitmap and mounts the volume as
     read-only (SB_RDONLY) to prevent further damage.

   - Validate catalog CNIDs before instantiating inodes (David
     Maximiliano Hermitte)

     The hfs_cat_find_brec() first resolves a catalog thread record by
     CNID and then looks up the corresponding catalog record by
     parent/name. On a corrupted filesystem image, the second lookup may
     find a record whose CNID does not match the CNID that was
     requested. Finally, corrupted catalog records are rejected.

   - Validate B-tree record offset table (Jiaming Zhang)

     A crafted HFS+ image can contain a corrupted B-tree node. The node
     descriptor may contain a record count that does not fit in the
     node, and record offsets may be unordered, unaligned, outside the
     node, or point into the offset table itself. Validate num_recs
     against the node size before walking the record offset table.
     Reject record ranges that are unordered, unaligned, outside the
     node, or overlapping the offset table. Reject invalid record
     indexes before reading their offset entries, and avoid decrementing
     an already-zero leaf_count.

   - Refactoring of hfsplus_delete_cat() logic (Kyle Zeng).

     The hfsplus_delete_cat() is called with str == NULL when the last
     open reference to an unlinked HFS+ hardlink backing inode is
     closed. In that case, the function finds the catalog thread by CNID
     and rebuilds the catalog key from thread.nodeName. A corrupted
     image can therefore provide an oversized thread name length and
     make hfs_bnode_read() write past the catalog search-key allocation.
     Read the CNID record through hfsplus_brec_read_cat(), which bounds
     the record read to sizeof(hfsplus_cat_entry) and verifies that a
     thread record's size exactly matches nodeName.length.

   - Cleanup in KUnit test (Mohammad Shahid)

     The kfree() safely handles NULL pointers, so the explicit NULL
     check in free_mock_str_env() before calling kfree() is unnecessary.

  The rest contain fixes of generic/564 xfstests' test-case failure
  for the case of HFS+ file system, syzbot reported issue in
  hfs_mdb_commit() and hfs_mdb_close() methods of HFS file system,
  and reworking the MDB locking scheme in HFS file system"

* tag 'hfs-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
  hfsplus: validate extent record length before writing it back
  hfsplus: validate B-tree record offset table
  hfs: rework MDB locking scheme
  fs: hfsplus: remove redundant NULL check before kfree()
  hfs: port HFS+ b-tree bitmap corruption check
  hfs: don't re-dirty MDB buffers after a write failure
  hfsplus: fix error code when writing beyond volume capacity
  hfs: fix error code when writing beyond volume capacity
  hfsplus: validate thread record before delete key rebuild
  hfs: validate catalog CNIDs before instantiating inodes

0 files changed, 0 insertions, 0 deletions