Re: [syzbot] Monthly fs report (Sep 2026)

[Christian Brauner]

On Thu, Sep 10, 2026 at 09:33:26PM -0700, syzbot wrote:
> Hello fs maintainers/developers,
> 
> This is a 31-day syzbot report for the fs subsystem.
> All related reports/information can be found at:
> https://syzkaller.appspot.com/upstream/s/fs
> 
> During the period, 3 new issues were detected and 3 were fixed.
> In total, 46 issues are still open and 642 have already been fixed.
> There are also 30 low-priority issues.
> 
> Some of the still happening issues:
> 
> Ref  Crashes Repro Title
> <1>  10972   Yes   KASAN: use-after-free Read in hpfs_get_ea
>                    https://syzkaller.appspot.com/bug?extid=fa88eb476e42878f2844

hpfs

> <2>  8730    Yes   INFO: task hung in __iterate_supers
>                    https://syzkaller.appspot.com/bug?extid=b10aefdd9ef275e9j368d
> <3>  2032    Yes   INFO: task hung in user_get_super (2)
>                    https://syzkaller.appspot.com/bug?extid=ba09f4a317431df6cddf
> <4>  2002    Yes   INFO: task hung in lookup_slow (3)
>                    https://syzkaller.appspot.com/bug?extid=7cfc6a4f6b025f710423

ext4/vfat/sysv/9p

> <5>  33      Yes   general protection fault in __simple_recursive_removal (2)
>                    https://syzkaller.appspot.com/bug?extid=cc460646984184ad435a
> <6>  26      Yes   KASAN: slab-use-after-free Read in lockref_get (2)

Both <5> and <6> are ic2 core races and fixed in v7.3-rc1 by b15b548d52b4.
They were tagged with another syzbot id. In any case, no fs bug so:

So both should get:

#syz fix: i2c: core: fix debugfs UAF on adapter removal


> <7>  25      Yes   INFO: rcu detected stall in sys_close (7)
>                    https://syzkaller.appspot.com/bug?extid=393022c13d02e1f680e3

NOT FS: taprio qdisc hrtimer storm via RTM_NEWQDISC.

> <8>  25      Yes   VFS: Close: file count is zero (use-after-free) (2)
>                    https://syzkaller.appspot.com/bug?extid=592c653b056459925299

NOT FS: That's a gaudio_cleanup() thing with a fix on-list. Remove it
from the fs list, please.

> <9>  22      Yes   INFO: task hung in writeback_iter (3)
>                    https://syzkaller.appspot.com/bug?extid=1e3ff4b07c16ca0f6fe2

FIXED: The mdb_bh versus bitmap folio deadlock was fixed by f26da7e0381c in v7.3-rc1.
This is just reproed in multiple fses and thus kept open. Kill it.

> <10> 22      No    possible deadlock in uvcg_mjpeg_bma_controls_show
>                    https://syzkaller.appspot.com/bug?extid=2b082cefcfb1439289ef

NOT FS: Deadlock in USB