[GIT PULL] hfs/hfsplus changes for 7.3-rc1

Hello Linus,

This pull request contains several fixes in HFS/HFS+ of syzbot
reported issues and HFS/HFS+ fixes of xfstests failures.

Aditya Prakash Srivastava has implemented porting of
b-tree bitmap corruption check for HFS file system.
During b-tree open (hfs_btree_open()), the code verifies that
the allocation map bit for the tree header (node 0) is set.
If not, it indicates a corrupted map record/bitmap and mounts
the volume as read-only (SB_RDONLY) to prevent further damage.

David Maximiliano Hermitte has implemented the validation of
catalog CNIDs before instantiating inodes in HFS file system.
The hfs_cat_find_brec() first resolves a catalog thread record
by CNID and then looks up the corresponding catalog record
by parent/name. On a corrupted filesystem image, the second
lookup may find a record whose CNID does not match the CNID
that was requested. Finally, corrupted catalog records are
rejected.

Jiaming Zhang has implemented the validation of B-tree record
offset table. A crafted HFS+ image can contain a corrupted B-tree
node. The node descriptor may contain a record count that
does not fit in the node, and record offsets may be unordered,
unaligned, outside the node, or point into the offset table itself.
Validate num_recs against the node size before walking the record
offset table. Reject record ranges that are unordered, unaligned,
outside the node, or overlapping the offset table. Reject invalid
record indexes before reading their offset entries, and avoid
decrementing an already-zero leaf_count.

Kyle Zeng implemented nice refactoring of hfsplus_delete_cat()
logic. The hfsplus_delete_cat() is called with str == NULL when
the last open reference to an unlinked HFS+ hardlink backing
inode is closed. In that case, the function finds the catalog thread
by CNID and rebuilds the catalog key from thread.nodeName.
A corrupted image can therefore provide an oversized thread name length
and make hfs_bnode_read() write past the catalog search-key allocation.
Read the CNID record through hfsplus_brec_read_cat(), which bounds the
record read to sizeof(hfsplus_cat_entry) and verifies that a thread
record's size exactly matches nodeName.length.

Mohammad Shahid has made cleanup in KUnit test. The kfree() safely
handles NULL pointers, so the explicit NULL check in
free_mock_str_env() before calling kfree() is unnecessary.

The rest patches contain fixes of generic/564 xfstests' test-case
failure for the case of HFS+ file system, syzbot reported issue in
hfs_mdb_commit() and hfs_mdb_close() methods of HFS file system, and
reworking the MDB locking scheme in HFS file system.

The following changes since commit
dc59e4fea9d83f03bad6bddf3fa2e52491777482:

  Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs.git
tags/hfs-v7.3-tag1

for you to fetch changes up to
627b7865c062ff642c0000f3a4775f1a44b986a4:

  hfsplus: validate extent record length before writing it back (2026-
08-11 16:37:16 -0700)

----------------------------------------------------------------
hfs/hfsplus updates for v7.3

- hfsplus: validate extent record length before writing it back
- hfsplus: validate B-tree record offset table
- hfs: rework MDB locking scheme
- fs: hfsplus: remove redundant NULL check before kfree()
- hfs: port HFS+ b-tree bitmap corruption check
- hfs: don't re-dirty MDB buffers after a write failure
- hfsplus: fix error code when writing beyond volume capacity
- hfs: fix error code when writing beyond volume capacity
- hfsplus: validate thread record before delete key rebuild
- hfs: validate catalog CNIDs before instantiating inodes

----------------------------------------------------------------
Aditya Prakash Srivastava (1):
      hfs: port HFS+ b-tree bitmap corruption check

David Maximiliano Hermitte (1):
      hfs: validate catalog CNIDs before instantiating inodes

Jiaming Zhang (2):
      hfsplus: validate B-tree record offset table
      hfsplus: validate extent record length before writing it back

Kyle Zeng (1):
      hfsplus: validate thread record before delete key rebuild

Mohammad Shahid (1):
      fs: hfsplus: remove redundant NULL check before kfree()

Viacheslav Dubeyko (4):
      hfs: fix error code when writing beyond volume capacity
      hfsplus: fix error code when writing beyond volume capacity
      hfs: don't re-dirty MDB buffers after a write failure
      hfs: rework MDB locking scheme

 fs/hfs/bnode.c             |  42 ---------
 fs/hfs/btree.c             | 210 ++++++++++++++++++++++++++++++++++++-
--------
 fs/hfs/btree.h             |  40 +++++++++
 fs/hfs/catalog.c           |  41 ++++++++-
 fs/hfs/hfs_fs.h            |  33 ++++++-
 fs/hfs/inode.c             |  23 ++++-
 fs/hfs/mdb.c               | 110 +++++++++++++++++++-----
 fs/hfs/super.c             |  20 ++++-
 fs/hfsplus/bfind.c         |  23 ++---
 fs/hfsplus/bnode.c         |  16 +++-
 fs/hfsplus/brec.c          |  53 ++++++++----
 fs/hfsplus/btree.c         |  16 +++-
 fs/hfsplus/catalog.c       |  25 +++---
 fs/hfsplus/extents.c       |   2 +
 fs/hfsplus/hfsplus_fs.h    |  85 ++++++++++++++++++
 fs/hfsplus/inode.c         |  10 ++-
 fs/hfsplus/unicode_test.c  |   3 +-
 include/linux/hfs_common.h |  13 ++-
 18 files changed, 600 insertions(+), 165 deletions(-)