CVE-2023-53862

In the Linux kernel, the following vulnerability has been resolved:

hfs: fix missing hfsbnodeget() in __hfsbnodecreate

Syzbot found a kernel BUG in hfsbnodeput():

kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wbworkfn (flush-7:0) RIP: 0010:hfsbnodeput+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfswriteinode+0x1bc/0xb40 writeinode fs/fs-writeback.c:1440 [inline] __writebacksingleinode+0x4d6/0x670 fs/fs-writeback.c:1652 writebacksbinodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 _writebackinodeswb+0x125/0x420 fs/fs-writeback.c:1949 wbwriteback+0x440/0x7b0 fs/fs-writeback.c:2054 wbcheckstartall fs/fs-writeback.c:2176 [inline] wbdowriteback fs/fs-writeback.c:2202 [inline] wbworkfn+0x827/0xef0 fs/fs-writeback.c:2235 processonework+0x877/0xdb0 kernel/workqueue.c:2289 workerthread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:306 </TASK>

The BUG_ON() is triggered at here:

/* Dispose of resources used by a node */ void hfsbnodeput(struct hfsbnode *node) { if (node) { <skipped> BUGON(!atomic_read(&node->refcnt)); <- we have issue here!!!! <skipped> } }

By tracing the refcnt, I found the node is created by hfsbmapalloc() with refcnt 1. Then the node is used by hfsbtreewrite(). There is a missing of hfsbnodeget() after find the node. The issue happened in following path:

<alloc> hfsbmapalloc hfsbnodefind __hfsbnodecreate <- allocate a new node with refcnt 1. hfsbnodeput <- decrease the refcnt

<write> hfsbtreewrite hfsbnodefind _hfsbnodecreate hfsbnodefindhash <- find the node without refcnt increased. hfsbnodeput <- trigger the BUGON() since refcnt is 0.