From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from leontynka.twibright.com (leontynka.twibright.com [109.81.181.203]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDAE32CCC5 for ; Tue, 11 Aug 2026 08:19:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=109.81.181.203 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786436398; cv=none; b=bNlHR7wPcUiln6K7nfd4oQPVKywT7jMAkHZpHaTTvibkf0ZpEehLLml21O9s+F26JHC5KDZac5sJGfr3C6OfWOIAKm2+zJzTSQPDT/gNiQFXAVD/H2i8peO9cF+6pDnXtX+aNh6PgUDpyevWIKtbd70jGW/MB3Cnzkls7/lfqcg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786436398; c=relaxed/simple; bh=FyhMbm1TNQdT7lALokB/lP6q/XFgL1MbnwzcX9LvVeE=; h=Date:From:To:cc:Subject:In-Reply-To:Message-ID:References: MIME-Version:Content-Type; b=X9v9I18QyaYLRN+jZvVgDbJq9rPEYL0Z42Hyqg2dsAGRbWUUv3upC0PB6wGIts1cjejGX/N5MWiucbgHp2useChUIavQWIl9lVviHXd34jSLKe/J8LtwIdMN4YXTxW9vXUVDTc9YQt5mjz/E4Q6E2F9NzriadHkcCjSB1Tlg8r0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=twibright.com; spf=pass smtp.mailfrom=twibright.com; arc=none smtp.client-ip=109.81.181.203 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=twibright.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=twibright.com Received: from mikulas (helo=localhost) by leontynka.twibright.com with local-esmtp (Exim 4.96) (envelope-from ) id 1wthCj-003kLd-0P; Tue, 11 Aug 2026 09:47:21 +0200 Date: Tue, 11 Aug 2026 09:47:21 +0200 (CEST) From: Mikulas Patocka To: ZW Tang cc: Mikulas Patocka , linux-kernel@vger.kernel.org Subject: Re: [BUG] hpfs: KASAN use-after-free in hpfs_get_ea() In-Reply-To: Message-ID: <1071222b-a18b-62c5-5c6d-4e5fa8c94d58@twibright.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII On Tue, 11 Aug 2026, ZW Tang wrote: > Hi, > > I am reporting a KASAN use-after-free issue triggered by a syzkaller > reproducer on Linux 7.2-rc3. > > Although a similar HPFS issue appears to have been reported before, I > can still trigger this KASAN use-after-free on Linux 7.2-rc3 with the > attached syzkaller reproducer. > > The reproducer mounts a crafted HPFS filesystem image. During mount, HPFS > reports several filesystem errors and then triggers a KASAN use-after-free > in strcmp(), called from hpfs_get_ea(). The crash happens while HPFS is > reading inode metadata during hpfs_fill_super(). > > This looks like a potential HPFS extended-attribute parsing or lifetime > handling issue when processing a malformed filesystem image. The HPFS code > appears to pass an invalid or already-freed string pointer to strcmp() from > hpfs_get_ea(). > > Reproducer: > syz reproducer: https://pastebin.com/raw/GRAS4KFk > console output: https://pastebin.com/raw/bnUVVvva > kernel config: https://pastebin.com/raw/nRnxH6Bi > > Kernel: > kernel version: 7.2.0-rc3 #1 > preemption model: PREEMPT(full) > HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809 > environment: QEMU Ubuntu 24.10 > taint: Not tainted > > Relevant log: > > loop0: detected capacity change from 0 to 128 > > hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: > 2066844985; already mounted read-only > hpfs: filesystem error: improperly stopped > hpfs: filesystem error: warning: spare dnodes used, try chkdsk > hpfs: You really don't want any checks? You are crazy... > hpfs: hpfs_map_sector(): read error > hpfs: code page support is disabled > > BUG: KASAN: use-after-free in strcmp+0xa7/0xb0 > Read of size 1 at addr ffff8880776368a6 by task syz.0.17/10816 > > CPU: 0 UID: 0 PID: 10816 Comm: syz.0.17 Not tainted 7.2.0-rc3 #1 PREEMPT(full) > Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996), BIOS > 1.16.3-debian-1.16.3-2 04/01/2014 > > Call Trace: > > dump_stack_lvl > print_report > kasan_report > strcmp > hpfs_get_ea > hpfs_read_inode > hpfs_fill_super > get_tree_bdev_flags > vfs_get_tree > fc_mount > path_mount > do_mount > __x64_sys_mount > do_syscall_64 > entry_SYSCALL_64_after_hwframe > > > The syzkaller program uses syz_mount_image$hpfs() with mount options including > err_ro, chkdsk_no, case_asis, and check_none. The crafted image appears to Hi The check_none option just does what it's supposed to do - disable consistency checking. As a consequence of using the this option, the filesystem hit the error. Don't fuzz the filesystem with the check_none option. Mikulas > drive HPFS into the inode / extended-attribute parsing path, where the stale > string pointer is later dereferenced by strcmp(). > > The system then panics because panic_on_warn is set: > > Kernel panic - not syncing: KASAN: panic_on_warn set ... > > Thanks > >