syzbot

 sign-in | mailing list | source | docs
🐞 Open [914]
🐞 Fixed [143]
🐞 Invalid [1102]
⬇ Missing Backports [73]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in hpfs_get_ea

Status: upstream: reported C repro on 2025/07/27 17:28
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+98d90f982e59bdb12f21@syzkaller.appspotmail.com
First crash: 291d, last: 1d02h
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/07/28 upstream (ToT) 038d61fd6422 C [report] KASAN: use-after-free Read in hpfs_get_ea
2026/04/24 upstream (ToT) dd6c438c3e64 C Failed due to an error; will retry later
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in hpfs_get_ea origin:upstream 19 C 528 4d09h 292d 0/3 upstream: reported C repro on 2025/07/26 19:47
upstream KASAN: use-after-free Read in hpfs_get_ea fs 19 C error 8220 3h43m 301d 0/29 upstream: reported C repro on 2025/07/17 19:14
linux-6.6 KASAN: use-after-free Read in hpfs_get_ea origin:upstream 19 C error 381 4d08h 291d 0/2 upstream: reported C repro on 2025/07/27 17:30

Sample crash report:
hpfs: You really don't want any checks? You are crazy...
hpfs: hpfs_map_sector(): read error
hpfs: code page support is disabled
==================================================================
BUG: KASAN: use-after-free in strcmp+0xbc/0xf0 lib/string.c:361
Read of size 1 at addr ffff0000e975a8a6 by task syz.0.21/4492

CPU: 0 PID: 4492 Comm: syz.0.21 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 strcmp+0xbc/0xf0 lib/string.c:361
 hpfs_get_ea+0xfc/0xa2c fs/hpfs/ea.c:139
 hpfs_read_inode+0x168/0xce8 fs/hpfs/inode.c:63
 hpfs_fill_super+0xe98/0x1850 fs/hpfs/super.c:712
 mount_bdev+0x264/0x358 fs/super.c:1443
 hpfs_mount+0x44/0x58 fs/hpfs/super.c:758
 legacy_get_tree+0xd4/0x16c fs/fs_context.c:632
 vfs_get_tree+0x90/0x274 fs/super.c:1573
 do_new_mount+0x228/0x810 fs/namespace.c:3078
 path_mount+0x5bc/0xe80 fs/namespace.c:3408
 do_mount fs/namespace.c:3421 [inline]
 __do_sys_mount fs/namespace.c:3629 [inline]
 __se_sys_mount fs/namespace.c:3606 [inline]
 __arm64_sys_mount+0x49c/0x59c fs/namespace.c:3606
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:000000002aef3e28 refcount:1 mapcount:1 mapping:0000000000000000 index:0x23f6f706d pfn:0x12975a
memcg:ffff0000c0940000
anon flags: 0x5ffe000000a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffe000000a0014 fffffc0003b78748 fffffc0003a5d6c8 ffff0000c7168cc1
raw: 000000023f6f706d 0000000000000000 0000000100000000 ffff0000c0940000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000e975a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000e975a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000e975a880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                               ^
 ffff0000e975a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000e975a980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
hpfs: hpfs_map_sector(): read error
hpfs: hpfs_map_sector(): read error
hpfs: hpfs_map_sector(): read error
hpfs: hpfs_map_sector(): read error
hpfs: hpfs_map_4sectors(): unaligned read
hpfs: hpfs_map_4sectors(): unaligned read
hpfs: filesystem error: unable to find root dir

Crashes (1018):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/10 03:23 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/12/30 09:32 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/11/05 19:02 linux-6.1.y f6e38ae624cf a6c9c731 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/07/27 18:15 linux-6.1.y 3594f306da12 fb8f743d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/07/27 17:46 linux-6.1.y 3594f306da12 fb8f743d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/08 06:43 linux-6.1.y 4931e0e1673d 5633175a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/26 13:36 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/26 10:03 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/25 18:11 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/23 09:48 linux-6.1.y 7c87defbd336 b10da5ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/21 03:48 linux-6.1.y 7c87defbd336 3f2e655b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/21 00:27 linux-6.1.y 7c87defbd336 e65da4ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/20 13:57 linux-6.1.y 7c87defbd336 e65da4ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/18 22:51 linux-6.1.y 7c87defbd336 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/15 18:53 linux-6.1.y 8e8fc038cad5 c441f497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/15 11:13 linux-6.1.y 8e8fc038cad5 c441f497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/15 09:26 linux-6.1.y 8e8fc038cad5 e2e976a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/13 19:24 linux-6.1.y 8e8fc038cad5 9530ccf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/13 17:42 linux-6.1.y 8e8fc038cad5 9530ccf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/11 23:24 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/06 22:00 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/04/06 22:00 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hpfs_get_ea
2026/05/14 12:47 linux-6.1.y ad16b162f21d 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/11 19:03 linux-6.1.y ad16b162f21d d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/11 07:57 linux-6.1.y ad16b162f21d 845acb1c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/10 07:12 linux-6.1.y 128a674368bf 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/10 05:50 linux-6.1.y 128a674368bf 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/04 07:36 linux-6.1.y 4931e0e1673d 85f1bcf2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/03 01:15 linux-6.1.y 4931e0e1673d a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/02 06:12 linux-6.1.y 4931e0e1673d 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/05/01 12:13 linux-6.1.y 4931e0e1673d 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/27 20:58 linux-6.1.y 7c87defbd336 ce741359 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/27 08:36 linux-6.1.y 7c87defbd336 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/27 05:03 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/26 05:39 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/25 00:13 linux-6.1.y 7c87defbd336 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/24 11:53 linux-6.1.y 7c87defbd336 1c2b9291 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/24 07:35 linux-6.1.y 7c87defbd336 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/23 23:31 linux-6.1.y 7c87defbd336 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/23 21:17 linux-6.1.y 7c87defbd336 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/22 21:40 linux-6.1.y 7c87defbd336 4595e353 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/22 20:02 linux-6.1.y 7c87defbd336 4595e353 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/22 08:19 linux-6.1.y 7c87defbd336 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/22 08:19 linux-6.1.y 7c87defbd336 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/19 21:27 linux-6.1.y 7c87defbd336 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/18 18:48 linux-6.1.y 7c87defbd336 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/14 20:13 linux-6.1.y 8e8fc038cad5 362d1323 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/14 10:30 linux-6.1.y 8e8fc038cad5 362d1323 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/13 22:27 linux-6.1.y 8e8fc038cad5 1a086e7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/13 10:02 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/12 21:06 linux-6.1.y 8e8fc038cad5 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/11 10:47 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/10 12:30 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/10 02:55 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/07 22:30 linux-6.1.y 1989cd3d56e2 2c961e87 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/07 09:20 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2026/04/07 01:27 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/07/27 17:27 linux-6.1.y 3594f306da12 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hpfs_get_ea
2025/10/31 23:01 linux-6.1.y f6e38ae624cf 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: out-of-bounds Read in hpfs_get_ea
2026/04/06 14:56 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: slab-out-of-bounds Read in hpfs_get_ea
* Struck through repros no longer work on HEAD.