[v2] hfsplus: Initialize directory subfolders in hfsplus_mknod

Commit Message

Siddharth Menon July 27, 2024, 6:13 a.m. UTC

Addresses uninitialized subfolders attribute being used in 
`hfsplus_subfolders_inc` and `hfsplus_subfolders_dec`.

Fixes: https://syzkaller.appspot.com/bug?extid=fdedff847a0e5e84c39f
Reported-by: [e-mail]
Closes: https://syzkaller.appspot.com/x/report.txt?x=16efda06680000
Signed-off-by: Siddharth Menon <[e-mail]>
---
Removed changes that was accidentally added while debugging
and reformatted the message.

 fs/hfsplus/dir.c | 3 +++
 1 file changed, 3 insertions(+)
644

Comments

Matthew Wilcox July 27, 2024, 2:52 p.m. UTC | #1

On Sat, Jul 27, 2024 at 11:43:04AM +0530, Siddharth Menon wrote:
> Addresses uninitialized subfolders attribute being used in 
> `hfsplus_subfolders_inc` and `hfsplus_subfolders_dec`.

This is a really poor commit message.  It needs to be more descriptive.
How can this happen?  Is it just a fuzzing thing?

> Fixes: https://syzkaller.appspot.com/bug?extid=fdedff847a0e5e84c39f
> Reported-by: [e-mail]
> Closes: https://syzkaller.appspot.com/x/report.txt?x=16efda06680000
> Signed-off-by: Siddharth Menon <[e-mail]>
> ---
> Removed changes that was accidentally added while debugging
> and reformatted the message.
> 
>  fs/hfsplus/dir.c | 3 +++
>  1 file changed, 3 insertions(+)
> 644
> --- a/fs/hfsplus/dir.c
> +++ b/fs/hfsplus/dir.c
> @@ -485,6 +485,9 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir,
>  
>  	mutex_lock(&sbi->vh_mutex);
>  	inode = hfsplus_new_inode(dir->i_sb, dir, mode);
> +	if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
> +		HFSPLUS_I(dir)->subfolders = 0;
> +
>  	if (!inode)
>  		goto out;
>  
> -- 
> 2.39.2
> 
>

Patch

--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -485,6 +485,9 @@  static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir,
 
 	mutex_lock(&sbi->vh_mutex);
 	inode = hfsplus_new_inode(dir->i_sb, dir, mode);
+	if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+		HFSPLUS_I(dir)->subfolders = 0;
+
 	if (!inode)
 		goto out;