Re: [syzbot] [fs?] KASAN: use-after-free Read in hpfs_get_ea

From: Tetsuo Handa

Date: Tue Oct 14 2025 - 07:12:10 EST


#syz test

diff --git a/fs/hpfs/Kconfig b/fs/hpfs/Kconfig
index ac1e9318e65a..d3dfbe76be8a 100644
--- a/fs/hpfs/Kconfig
+++ b/fs/hpfs/Kconfig
@@ -15,3 +15,14 @@ config HPFS_FS

To compile this file system support as a module, choose M here: the
module will be called hpfs. If unsure, say N.
+
+config HPFS_FS_ALLOW_NO_ERROR_CHECK_MODE
+ bool "Allow no-error-check mode for maximum speed"
+ depends on HPFS_FS
+ default n
+ help
+ This option enables check=none mount option. If check=none is
+ specified, users can expect maximum speed at the cost of minimum
+ robustness. Sane users should not specify check=none option, for e.g.
+ use-after-free bug will happen when the filesystem is corrupted or
+ crafted.
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index 42b779b4d87f..558093b2beab 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -285,7 +285,9 @@ static const struct constant_table hpfs_param_case[] = {
};

static const struct constant_table hpfs_param_check[] = {
+#ifdef CONFIG_HPFS_FS_ALLOW_NO_ERROR_CHECK_MODE
{"none", 0},
+#endif
{"normal", 1},
{"strict", 2},
{}