hpfs: You really don't want any checks? You are crazy... hpfs: hpfs_map_sector(): read error hpfs: code page support is disabled ================================================================== BUG: KASAN: use-after-free in strcmp+0xbc/0xf0 lib/string.c:361 Read of size 1 at addr ffff0000e4cb8001 by task syz.5.363/6177 CPU: 0 PID: 6177 Comm: syz.5.363 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report+0xa8/0xfc mm/kasan/report.c:524 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348 strcmp+0xbc/0xf0 lib/string.c:361 hpfs_get_ea+0x100/0xa24 fs/hpfs/ea.c:139 hpfs_read_inode+0x164/0xd18 fs/hpfs/inode.c:63 hpfs_fill_super+0xe80/0x18a4 fs/hpfs/super.c:712 mount_bdev+0x264/0x35c fs/super.c:1454 hpfs_mount+0x44/0x58 fs/hpfs/super.c:758 legacy_get_tree+0xd8/0x174 fs/fs_context.c:632 vfs_get_tree+0x90/0x278 fs/super.c:1584 do_new_mount+0x228/0x804 fs/namespace.c:3078 path_mount+0x5ac/0xe6c fs/namespace.c:3408 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount fs/namespace.c:3606 [inline] __arm64_sys_mount+0x4a0/0x5a0 fs/namespace.c:3606 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:00000000ed3a3aca refcount:0 mapcount:-128 mapping:0000000000000000 index:0x1 pfn:0x124cb8 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffc0003e9c208 fffffc0003ea2608 0000000000000000 raw: 0000000000000001 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000e4cb7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000e4cb7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0000e4cb8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000e4cb8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000e4cb8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== hpfs: hpfs_map_sector(): read error hpfs: hpfs_map_sector(): read error hpfs: hpfs_map_sector(): read error hpfs: hpfs_map_sector(): read error hpfs: hpfs_map_4sectors(): unaligned read hpfs: hpfs_map_4sectors(): unaligned read hpfs: filesystem error: unable to find root dir FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 6177 Comm: syz.5.363 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 fail_dump lib/fault-inject.c:52 [inline] should_fail_ex+0x3cc/0x524 lib/fault-inject.c:147 __should_failslab+0xc0/0x11c mm/failslab.c:44 should_failslab+0x10/0x28 mm/slab_common.c:1440 slab_pre_alloc_hook mm/slab.h:712 [inline] slab_alloc_node mm/slub.c:3279 [inline] __kmem_cache_alloc_node+0x7c/0x318 mm/slub.c:3398 __do_kmalloc_node mm/slab_common.c:935 [inline] __kmalloc_node+0xc8/0x184 mm/slab_common.c:943 kmalloc_array_node include/linux/slab.h:676 [inline] kcalloc_node include/linux/slab.h:681 [inline] memcg_alloc_slab_cgroups+0x90/0x164 mm/memcontrol.c:2889 memcg_slab_post_alloc_hook mm/slab.h:528 [inline] slab_post_alloc_hook+0xc0/0x430 mm/slab.h:745 slab_alloc_node mm/slub.c:3359 [inline] __kmem_cache_alloc_node+0x278/0x318 mm/slub.c:3398 __do_kmalloc_node mm/slab_common.c:935 [inline] __kmalloc_node+0xc8/0x184 mm/slab_common.c:943 kmalloc_node include/linux/slab.h:589 [inline] kvmalloc_node+0x88/0x1d4 mm/util.c:581 kvmalloc include/linux/slab.h:716 [inline] seq_buf_alloc fs/seq_file.c:38 [inline] seq_read_iter+0x1d8/0xc24 fs/seq_file.c:210 call_read_iter include/linux/fs.h:2265 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x3cc/0x7b8 fs/read_write.c:470 ksys_read+0x12c/0x228 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __arm64_sys_read+0x7c/0x90 fs/read_write.c:621 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585