KASAN: use-after-free Write in ext2_try_to_allocate on v7.3-rc2

KASAN: use-after-free Write in ext2_try_to_allocate on v7.3-rc2

[CJ]

Hi,


syzbot reported "KASAN: use-after-free Write in ext2_try_to_allocate" on Linux 6.1. The same failure is still
reproducible on v7.3-rc2 with the adapted reproducer described below.


The reproducer mounts a crafted ext2/ext3 image and creates directories in the mounted root. The adapted syz program adds explicit mkdirat calls immediately after the image mount, restoring the ext2_mkdir and ext2_make_empty block-allocation path. The image, mount option, and unrelated calls are preserved.


The target console reports a KASAN use-after-free write in ext2_try_to_allocate, with the allocation path passing through ext2_try_to_allocate_with_rsv, ext2_new_blocks, ext2_make_empty, ext2_mkdir, and vfs_mkdir.


The write occurs while ext2 allocates blocks for a new directory. The console does not identify whether the stale object is a group descriptor, bitmap buffer, or another allocation structure.


This is a follow-up for the existing syzbot report https://syzkaller.appspot.com/bug?extid=8a47e292db85a3b20c76, not a
bisected root cause. The target report shares
12 key frames with the source crash report.


Reproducer:
  syz reproducer: https://pastebin.com/raw/HjbfTeS1


console output: https://pastebin.com/raw/QZCacQcS
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=b1adc0bfde2d8a4a


Kernel:
  HEAD commit: df2908090cda368b01ff43709f51890076c56157
  git tree: linux-stable
  kernel version: 7.3.0-rc2
  tested tag: v7.3-rc2


Let me know if you need more details or testing.


Thanks.