[BUG] udf: possible use-after-free in udf_close_lvid

[BUG] udf: possible use-after-free in udf_close_lvid

[CJ]

Hi,


I am reporting that use-after-free in udf_close_lvid appears to remain
reproducible with a migrated syzkaller reproducer on Linux 7.2-rc3. The
tested HEAD commit is a13c140cc289c0b7b3770bce5b3ad42ab35074aa.


The reproducer mounts and unmounts a crafted UDF image, reaching
udf_put_super() and udf_close_lvid() during superblock teardown.


The target run faults in udf_close_lvid(), while the structurally matching
archived report identifies a use-after-free write in the same function and
teardown path.


This looks like lifetime or teardown ordering around the logical volume
integrity descriptor, allowing udf_close_lvid() to access storage that has
already been released.


This issue was previously reported at:


https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d


Reproducer:


syz reproducer:https://pastebin.com/raw/TS2t3YbZ


console output: https://pastebin.com/raw/F3Kw8uUb
kernel config: https://pastebin.com/raw/8dTgtKu5


Kernel:


HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full)
tested tag: v7.2-rc3


Let me know if you need more details or testing.


Best regards

Re: [BUG] udf: possible use-after-free in udf_close_lvid

[Jan Kara]

Hello!

On Thu 03-09-26 15:14:26, CJ wrote:
> I am reporting that use-after-free in udf_close_lvid appears to remain
> reproducible with a migrated syzkaller reproducer on Linux 7.2-rc3. The
> tested HEAD commit is a13c140cc289c0b7b3770bce5b3ad42ab35074aa.

You can try with linux-next. I have queued one UDF fix for incorrect LVID
handling.

> The reproducer mounts and unmounts a crafted UDF image, reaching
> udf_put_super() and udf_close_lvid() during superblock teardown.

I'm sorry but I don't have capacity to address all these "maliciously
corrupted image causes issues" bugs and I'm even less willing to run random
code fetched from pastebin.com. If the report is from official syzbot
instance, I might have a look on time-permitting basis. BTW the syzbot
report you reference below has long been fixed so that's a different bug
(although a similar backtrace).

								Honza

> The target run faults in udf_close_lvid(), while the structurally matching
> archived report identifies a use-after-free write in the same function and
> teardown path.
> 
> 
> This looks like lifetime or teardown ordering around the logical volume
> integrity descriptor, allowing udf_close_lvid() to access storage that has
> already been released.
> 
> 
> This issue was previously reported at:
> 
> 
> https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d
> 
> 
> Reproducer:
> 
> 
> syz reproducer:https://pastebin.com/raw/TS2t3YbZ
> 
> 
> console output: https://pastebin.com/raw/F3Kw8uUb
> kernel config: https://pastebin.com/raw/8dTgtKu5
> 
> 
> Kernel:
> 
> 
> HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
> git tree: torvalds/linux
> kernel version: 7.2.0-rc3 #1 PREEMPT(full)
> tested tag: v7.2-rc3
> 
> 
> Let me know if you need more details or testing.
> 
> 
> Best regards
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR