Re: [PATCH v7] hfsplus: fix null-ptr-deref by creating hidden dir on remount rw

[Viacheslav Dubeyko]

On Fri, 2026-10-30 at 22:23 -0300, Joas Antonio dos Santos wrote:
> On Fri, 17 Jul 2026 19:27:06 +0530, Deepanshu Kartikey wrote:
> > hfsplus_reconfigure() does not create the hidden directory when
> > remounting from read-only to read-write, leaving sbi->hidden_dir
> > as NULL.
> 
> I independently reproduced the syzbot null-ptr-deref and confirm the
> root cause: on a read-only mount of a volume whose on-disk "HFS+
> Private
> Data" directory is absent, sbi->hidden_dir stays NULL (it is created
> only in hfsplus_fill_super() under !sb_rdonly). After a remount,rw,
> hfsplus_unlink() -> hfsplus_cat_write_inode(sbi->hidden_dir)
> dereferences
> the NULL inode (inode->i_sb) during rename -- the reported crash in
> the
> [0x28-0x2f] range.
> 
> I applied v7 on c339f4010 and tested on arm64 with KASAN, using the
> crafted image from the syzbot reproducer and the equivalent sequence
> (mount -o ro -> mount -o remount,rw -> rename): without the patch
> this
> oopses in hfsplus_cat_write_inode; with v7 the remount,rw creates the
> hidden directory, the rename succeeds, and the KASAN splat is gone. A
> normal read-write mount + rename is unaffected.
> 
> Tested-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> 

I've reworked the v7 of the patch addressing my concerns and comments.
I will apply the v8 of the patch on HFS/HFS+ tree (for-next branch)
when 7.4-rc1 will be released.

Thanks,
Slava.