[BUG] hpfs: KASAN use-after-free in hpfs_get_ea()

[BUG] hpfs: KASAN use-after-free in hpfs_get_ea()

[ZW Tang]

Hi,

I am reporting a KASAN use-after-free issue triggered by a syzkaller
reproducer on Linux 7.2-rc3.

Although a similar HPFS issue appears to have been reported before, I
can still trigger this KASAN use-after-free on Linux 7.2-rc3 with the
attached syzkaller reproducer.

The reproducer mounts a crafted HPFS filesystem image. During mount, HPFS
reports several filesystem errors and then triggers a KASAN use-after-free
in strcmp(), called from hpfs_get_ea(). The crash happens while HPFS is
reading inode metadata during hpfs_fill_super().

This looks like a potential HPFS extended-attribute parsing or lifetime
handling issue when processing a malformed filesystem image. The HPFS code
appears to pass an invalid or already-freed string pointer to strcmp() from
hpfs_get_ea().

Reproducer:
syz reproducer: https://pastebin.com/raw/GRAS4KFk
console output: https://pastebin.com/raw/bnUVVvva
kernel config: https://pastebin.com/raw/nRnxH6Bi

Kernel:
kernel version: 7.2.0-rc3 #1
preemption model: PREEMPT(full)
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
environment: QEMU Ubuntu 24.10
taint: Not tainted

Relevant log:

loop0: detected capacity change from 0 to 128

hpfs: filesystem error: invalid number of hotfixes: 2066844986, used:
2066844985; already mounted read-only
hpfs: filesystem error: improperly stopped
hpfs: filesystem error: warning: spare dnodes used, try chkdsk
hpfs: You really don't want any checks? You are crazy...
hpfs: hpfs_map_sector(): read error
hpfs: code page support is disabled

BUG: KASAN: use-after-free in strcmp+0xa7/0xb0
Read of size 1 at addr ffff8880776368a6 by task syz.0.17/10816

CPU: 0 UID: 0 PID: 10816 Comm: syz.0.17 Not tainted 7.2.0-rc3 #1 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS
1.16.3-debian-1.16.3-2 04/01/2014

Call Trace:
<TASK>
dump_stack_lvl
print_report
kasan_report
strcmp
hpfs_get_ea
hpfs_read_inode
hpfs_fill_super
get_tree_bdev_flags
vfs_get_tree
fc_mount
path_mount
do_mount
__x64_sys_mount
do_syscall_64
entry_SYSCALL_64_after_hwframe
</TASK>

The syzkaller program uses syz_mount_image$hpfs() with mount options including
err_ro, chkdsk_no, case_asis, and check_none. The crafted image appears to
drive HPFS into the inode / extended-attribute parsing path, where the stale
string pointer is later dereferenced by strcmp().

The system then panics because panic_on_warn is set:

Kernel panic - not syncing: KASAN: panic_on_warn set ...

Thanks

Re: [BUG] hpfs: KASAN use-after-free in hpfs_get_ea()

[Mikulas Patocka]

On Tue, 11 Aug 2026, ZW Tang wrote:

> Hi,
> 
> I am reporting a KASAN use-after-free issue triggered by a syzkaller
> reproducer on Linux 7.2-rc3.
> 
> Although a similar HPFS issue appears to have been reported before, I
> can still trigger this KASAN use-after-free on Linux 7.2-rc3 with the
> attached syzkaller reproducer.
> 
> The reproducer mounts a crafted HPFS filesystem image. During mount, HPFS
> reports several filesystem errors and then triggers a KASAN use-after-free
> in strcmp(), called from hpfs_get_ea(). The crash happens while HPFS is
> reading inode metadata during hpfs_fill_super().
> 
> This looks like a potential HPFS extended-attribute parsing or lifetime
> handling issue when processing a malformed filesystem image. The HPFS code
> appears to pass an invalid or already-freed string pointer to strcmp() from
> hpfs_get_ea().
> 
> Reproducer:
> syz reproducer: https://pastebin.com/raw/GRAS4KFk
> console output: https://pastebin.com/raw/bnUVVvva
> kernel config: https://pastebin.com/raw/nRnxH6Bi
> 
> Kernel:
> kernel version: 7.2.0-rc3 #1
> preemption model: PREEMPT(full)
> HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
> environment: QEMU Ubuntu 24.10
> taint: Not tainted
> 
> Relevant log:
> 
> loop0: detected capacity change from 0 to 128
> 
> hpfs: filesystem error: invalid number of hotfixes: 2066844986, used:
> 2066844985; already mounted read-only
> hpfs: filesystem error: improperly stopped
> hpfs: filesystem error: warning: spare dnodes used, try chkdsk
> hpfs: You really don't want any checks? You are crazy...
> hpfs: hpfs_map_sector(): read error
> hpfs: code page support is disabled
> 
> BUG: KASAN: use-after-free in strcmp+0xa7/0xb0
> Read of size 1 at addr ffff8880776368a6 by task syz.0.17/10816
> 
> CPU: 0 UID: 0 PID: 10816 Comm: syz.0.17 Not tainted 7.2.0-rc3 #1 PREEMPT(full)
> Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
> 
> Call Trace:
> <TASK>
> dump_stack_lvl
> print_report
> kasan_report
> strcmp
> hpfs_get_ea
> hpfs_read_inode
> hpfs_fill_super
> get_tree_bdev_flags
> vfs_get_tree
> fc_mount
> path_mount
> do_mount
> __x64_sys_mount
> do_syscall_64
> entry_SYSCALL_64_after_hwframe
> </TASK>
> 
> The syzkaller program uses syz_mount_image$hpfs() with mount options including
> err_ro, chkdsk_no, case_asis, and check_none. The crafted image appears to

Hi

The check_none option just does what it's supposed to do - disable 
consistency checking. As a consequence of using the this option, the 
filesystem hit the error. Don't fuzz the filesystem with the check_none 
option.

Mikulas

> drive HPFS into the inode / extended-attribute parsing path, where the stale
> string pointer is later dereferenced by strcmp().
> 
> The system then panics because panic_on_warn is set:
> 
> Kernel panic - not syncing: KASAN: panic_on_warn set ...
> 
> Thanks
> 
>