In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: fix held lock freed on hfsplus_fill_super()<\/p>\n
hfsplus_fill_super() calls hfs_find_init() to initialize a search
\nstructure, which acquires tree->tree_lock. If the subsequent call to
\nhfsplus_cat_build_key() fails, the function jumps to the out_put_root
\nerror label without releasing the lock. The later cleanup path then
\nfrees the tree data structure with the lock still held, triggering a
\nheld lock freed warning.<\/p>\n
Fix this by adding the missing hfs_find_exit(&fd) call before jumping
\nto the out_put_root error label. This ensures that tree->tree_lock is
\nproperly released on the error path.<\/p>\n
The bug was originally detected on v6.13-rc1 using an experimental
\nstatic analysis tool we are developing, and we have verified that the
\nissue persists in the latest mainline kernel. The tool is specifically
\ndesigned to detect memory management issues. It is currently under active
\ndevelopment and not yet publicly available.<\/p>\n
We confirmed the bug by runtime testing under QEMU with x86_64 defconfig,
\nlockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we
\nused GDB to dynamically shrink the max_unistr_len parameter to 1 before
\nhfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally
\nreturn -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and
\nexercises the faulty error path. The following warning was observed
\nduring mount:<\/p>\n
\t=========================
\n\tWARNING: held lock freed!
\n\t7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted
\n\t————————-
\n\tmount\/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there!
\n\tffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154\/0x1e0
\n\t2 locks held by mount\/174:
\n\t#0: ffff888103f960e0 (&type->s_umount_key#42\/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167\/0xa40
\n\t#1: ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154\/0x1e0<\/p>\n
\tstack backtrace:
\n\tCPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy)
\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04\/01\/2014
\n\tCall Trace:<\/p>\n
\tdump_stack_lvl+0x82\/0xd0
\n\tdebug_check_no_locks_freed+0x13a\/0x180
\n\tkfree+0x16b\/0x510
\n\t? hfsplus_fill_super+0xcb4\/0x18a0
\n\thfsplus_fill_super+0xcb4\/0x18a0
\n\t? __pfx_hfsplus_fill_super+0x10\/0x10
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? bdev_open+0x65f\/0xc30
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? pointer+0x4ce\/0xbf0
\n\t? trace_contention_end+0x11c\/0x150
\n\t? __pfx_pointer+0x10\/0x10
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? bdev_open+0x79b\/0xc30
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? vsnprintf+0x6da\/0x1270
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? __mutex_unlock_slowpath+0x157\/0x740
\n\t? __pfx_vsnprintf+0x10\/0x10
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? mark_held_locks+0x49\/0x80
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? irqentry_exit+0x17b\/0x5e0
\n\t? trace_irq_disable.constprop.0+0x116\/0x150
\n\t? __pfx_hfsplus_fill_super+0x10\/0x10
\n\t? __pfx_hfsplus_fill_super+0x10\/0x10
\n\tget_tree_bdev_flags+0x302\/0x580
\n\t? __pfx_get_tree_bdev_flags+0x10\/0x10
\n\t? vfs_parse_fs_qstr+0x129\/0x1a0
\n\t? __pfx_vfs_parse_fs_qstr+0x3\/0x10
\n\tvfs_get_tree+0x89\/0x320
\n\tfc_mount+0x10\/0x1d0
\n\tpath_mount+0x5c5\/0x21c0
\n\t? __pfx_path_mount+0x10\/0x10
\n\t? trace_irq_enable.constprop.0+0x116\/0x150
\n\t? trace_irq_enable.constprop.0+0x116\/0x150
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? kmem_cache_free+0x307\/0x540
\n\t? user_path_at+0x51\/0x60
\n\t? __x64_sys_mount+0x212\/0x280
\n\t? srso_return_thunk+0x5\/0x5f
\n\t__x64_sys_mount+0x212\/0x280
\n\t? __pfx___x64_sys_mount+0x10\/0x10
\n\t? srso_return_thunk+0x5\/0x5f
\n\t? trace_irq_enable.constprop.0+0x116\/0x150
\n\t? srso_return_thunk+0x5\/0x5f
\n\tdo_syscall_64+0x111\/0x680
\n\tentry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n\tRIP: 0033:0x7ffacad55eae
\n\tCode: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8
\n\tRSP: 002b
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: fix held lock freed on hfsplus_fill_super()<\/p>\n
hfsplus_fill_super() calls hfs_find_init() to initialize a search
\nstructure, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15996","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}