Re: [PATCH] hfsplus: fix segfault when deleting all attrs of a file

[Viacheslav Dubeyko <slava@xxxxxxxxxxx>]

On Mon, 2017-10-09 at 16:59 -0300, Ernesto A. Fernández wrote:

> > 
> > 
> > 
> Here's the callstack, I hope it helps you:
> 
> [ 3550.503259] general protection fault: 0000 [#1] SMP
> [ 3550.503587] Modules linked in: nls_utf8 hfsplus loop nfsd
> auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc dlm
> configfs ppdev snd_pcm snd_timer cirrus snd soundcore ttm pcspkr
> evdev parport_pc parport pvpanic serio_raw drm_kms_helper button
> 9pnet_virtio 9pnet drm autofs4 xfs libcrc32c sg sr_mod sd_mod cdrom
> ata_generic ata_piix libata crc32c_intel psmouse virtio_pci
> virtio_ring virtio e1000 i2c_piix4 i2c_core scsi_mod floppy
> [ 3550.504013] CPU: 0 PID: 1072 Comm: rm Not tainted 4.14.0-rc3+ #16
> [ 3550.504013] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
> [ 3550.504013] task: ffff880058ab4000 task.stack: ffffc90001630000
> [ 3550.504013] RIP: 0010:hfsplus_bnode_write+0xa7/0x1c0 [hfsplus]
> [ 3550.504013] RSP: 0018:ffffc90001633c08 EFLAGS: 00010202
> [ 3550.504013] RAX: 0005100000000000 RBX: 0000000000000002 RCX:
> 00000000000000ff
> [ 3550.504013] RDX: 0000000000000000 RSI: ffffc90001633c56 RDI:
> ffff88002972d780
> [ 3550.504013] RBP: ffffc90001633c40 R08: ffff88002972d790 R09:
> 0000000000000000
> [ 3550.504013] R10: 0000000000000006 R11: 0000000000000002 R12:
> 0000000000000002
> [ 3550.504013] R13: 0000000000000002 R14: ffff88002972d7e0 R15:
> ffffc90001633c56
> [ 3550.504013] FS:  00007fc27f0c8700(0000) GS:ffff88007fc00000(0000)
> knlGS:0000000000000000
> [ 3550.504013] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 3550.504013] CR2: 00007fc27ec40450 CR3: 00000000584c6000 CR4:
> 00000000000006f0
> [ 3550.504013] Call Trace:
> [ 3550.504013]  hfsplus_bnode_write_u16+0x27/0x30 [hfsplus]
> [ 3550.504013]  hfsplus_brec_remove+0x117/0x170 [hfsplus]
> [ 3550.504013]  __hfsplus_delete_attr+0x94/0xf0 [hfsplus]
> [ 3550.504013]  hfsplus_delete_all_attrs+0x4a/0xb0 [hfsplus]
> [ 3550.504013]  hfsplus_delete_cat+0x1f5/0x300 [hfsplus]
> [ 3550.504013]  hfsplus_unlink+0x82/0x1e0 [hfsplus]
> [ 3550.504013]  ? __inode_permission+0x44/0xc0
> [ 3550.504013]  vfs_unlink+0xf1/0x180
> [ 3550.504013]  do_unlinkat+0x25f/0x2e0
> [ 3550.504013]  SyS_unlinkat+0x1b/0x30
> [ 3550.504013]  entry_SYSCALL_64_fastpath+0x1e/0xa9
> [ 3550.504013] RIP: 0033:0x7fc27ebe632d
> [ 3550.504013] RSP: 002b:00007fff036b4008 EFLAGS: 00000202 ORIG_RAX:
> 0000000000000107
> [ 3550.504013] RAX: ffffffffffffffda RBX: 00000000025cd2f0 RCX:
> 00007fc27ebe632d
> [ 3550.504013] RDX: 0000000000000000 RSI: 00000000025cc0c0 RDI:
> ffffffffffffff9c
> [ 3550.504013] RBP: 00000000025cd420 R08: 0000000000000003 R09:
> 0000000000000000
> [ 3550.504013] R10: 00007fff036b3dd0 R11: 0000000000000202 R12:
> 00000000025cc030
> [ 3550.504013] R13: 00000000025cd3f8 R14: 0000000000000000 R15:
> 0000000000000000
> [ 3550.504013] Code: c1 fb 06 48 c1 e3 0c 48 01 d8 49 63 dd 48 01 d0
> 48 83 fb 08 73 26 f6 c3 04 0f 85 04 01 00 00 48 85 db 74 44 41 0f b6
> 0f f6 c3 02 <88> 08 74 39 41 0f b7 4c 1f fe 66 89 4c 03 fe eb 2c 49
> 8b 0f 48
> [ 3550.504013] RIP: hfsplus_bnode_write+0xa7/0x1c0 [hfsplus] RSP:
> ffffc90001633c08
> [ 3550.540759] ---[ end trace 142de398139577f1 ]---

Great. Thank you.

I can reproduce the crash. Let me check the issue.

Thanks,
Vyacheslav Dubeyko.