[PATCH 0/2] ufs: harden the mount path against malformed images

[Ali Ahmet Memis <ali@iusegentoo.com>]

Two robustness fixes for the ufs mount path, both reachable by mounting
a crafted UFS image.

Patch 1 reorders ufs_fill_super() so the root dentry is created after the
cylinder group metadata is loaded. Today a failure while reading the
cylinder groups drops UFS_SB(sb) but leaves s_root installed, so the
generic teardown oopses on a NULL pointer in ufs_sync_fs() and the
put_super operation.

Patch 2 validates the cylinder group index and the rotor positions in
ufs_read_cylinder() before they are cached. Unchecked, c_cgx indexes the
cylinder summary array (a 32 bit write outside s_csp), and the rotors
become bitmap scan offsets that can wrap an unsigned length and walk past
the cylinder group buffers during an ordinary allocation.

Mounting a ufs image needs CAP_SYS_ADMIN and ufs is not
unprivileged-mountable, so this is image-parsing hardening rather than a
privilege boundary, handled in the open like the recent sibling work:

  ufs: reject malformed cylinder summary geometry
    https://lore.kernel.org/all/20260701215700.822003-1-kudo3228@gmail.com/
  ufs: reject oversized cylinder group metadata
    https://lore.kernel.org/all/20260717104033.38574-1-david.lee@trailofbits.com/

Those validate fs_cssize and fs_cgsize in ufs_fill_super(); the checks
here live in ufs_read_cylinder() and do not overlap with them.

Both were reproduced under KASAN on an unpatched kernel by mounting a
crafted UFS2 image.

Patch 1, an image whose first cylinder group fails the magic check, so
ufs_read_cylinder_structures() fails after the root dentry is installed:

  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
   ufs_sync_fs+0x5b/0x6d0
  BUG: kernel NULL pointer dereference, address: 0000000000000100

Patch 2, an image whose on-disk cg_cgx is out of range, followed by a
write that allocates a block:

  BUG: KASAN: slab-out-of-bounds in adjust_free_blocks+0x1bf0/0x2510
   adjust_free_blocks

With the patches applied, patch 1 loads the cylinder groups before
publishing the root dentry and patch 2 rejects the mismatched cg_cgx in
ufs_read_cylinder(), so neither faulting access is reached.

Ali Ahmet Memis (2):
  ufs: create the root dentry after loading cylinder metadata
  ufs: validate cylinder group metadata before caching it

 fs/ufs/cylinder.c | 10 ++++++++++
 fs/ufs/super.c    | 17 +++++++++--------
 2 files changed, 19 insertions(+), 8 deletions(-)

-- 
2.54.0