[PATCH] sys/linux/filesystem: remove hpfs check=none mount option

[Tetsuo Handa]

Mikulas Patocka (the HPFS maintainer) thinks that check=none option
should not be used in fuzz testing.

Closes https://syzkaller.appspot.com/bug?extid=fa88eb476e42878f2844
---
sys/linux/filesystem.txt | 1 -
1 file changed, 1 deletion(-)

diff --git a/sys/linux/filesystem.txt b/sys/linux/filesystem.txt
index d97f64fa0..4f1412583 100644
--- a/sys/linux/filesystem.txt
+++ b/sys/linux/filesystem.txt
@@ -1094,7 +1094,6 @@ hpfs_options [
umask fs_opt_oct["umask", int32]
case_lower stringnoz["case=lower"]
case_asis stringnoz["case=asis"]
- check_none stringnoz["check=none"]
check_normal stringnoz["check=normal"]
check_strict stringnoz["check=strict"]
err_cont stringnoz["errors=continue"]
--
2.51.0

[Tetsuo Handa]

Any questions?

[Aleksandr Nogikh]

Hi Tetsuo,

Could you please share a link to the original discussion with Mikulas Patocka?
It would be great to know a bit more context.

On Thu, Oct 16, 2025 at 2:29 PM Tetsuo Handa
<penguin...@i-love.sakura.ne.jp> wrote:
>
> Mikulas Patocka (the HPFS maintainer) thinks that check=none option
> should not be used in fuzz testing.
>
> Closes https://syzkaller.appspot.com/bug?extid=fa88eb476e42878f2844
> ---
> sys/linux/filesystem.txt | 1 -
> 1 file changed, 1 deletion(-)

FWIW

Considering how fuzzers work, it's challenging to prevent them from
doing something specific. Removing the descriptions is the necessary
first step, but
1) Mounts with check=none are already in the fuzzer corpuses, most
likely with multiple mutations on top.
2) Even without descriptions, syzkaller might discover this mount
option again in the future.

For cases like this, we unfortunately just keep on stacking the "when
mounting filesystem X, remove the substring Y if it's in the mount
options" rules in the C implementation of the syz_mount_image
pseudo-syscall:
https://github.com/google/syzkaller/blob/master/executor/common_linux.h#L3136

--
Aleksandr

[Tetsuo Handa]

On 2025/11/06 6:16, Aleksandr Nogikh wrote:
> Hi Tetsuo,
>
> Could you please share a link to the original discussion with Mikulas Patocka?
> It would be great to know a bit more context.

https://lkml.kernel.org/r/889ee229-8f2f-2bd4...@twibright.com
https://lkml.kernel.org/r/9ca81125-1c7b-ddaf...@redhat.com

>
> On Thu, Oct 16, 2025 at 2:29 PM Tetsuo Handa
> <penguin...@i-love.sakura.ne.jp> wrote:
>>
>> Mikulas Patocka (the HPFS maintainer) thinks that check=none option
>> should not be used in fuzz testing.
>>
>> Closes https://syzkaller.appspot.com/bug?extid=fa88eb476e42878f2844
>> ---
>> sys/linux/filesystem.txt | 1 -
>> 1 file changed, 1 deletion(-)
>
> FWIW
>
> Considering how fuzzers work, it's challenging to prevent them from
> doing something specific. Removing the descriptions is the necessary
> first step, but
> 1) Mounts with check=none are already in the fuzzer corpuses, most
> likely with multiple mutations on top.
> 2) Even without descriptions, syzkaller might discover this mount
> option again in the future.

Yes, syz_execute_func() (and other fuzzers) would find again.
That's why I proposed disabling in the kernel config.