[BUG] udf: kernel page fault in udf_add_fid_counter during unlink on crafted UDF image

[Zw Tang]

Hi,

I am reporting a kernel page fault triggered by a syzkaller reproducer on
Linux 7.2.0-rc3.

The reproducer mounts a crafted UDF filesystem image and later exercises
the unlink path. During unlink, UDF reaches udf_unlink(), deletes the file
identifier entry, and then calls udf_add_fid_counter() to update the UDF
FID counters. At this point the kernel faults while reading from an invalid
address and panics.

This looks like a UDF metadata validation / corruption handling issue in
the unlink path. A corrupted UDF image appears to leave the filesystem in a
state where udf_unlink() still proceeds to update the FID counter, while
udf_add_fid_counter() can dereference invalid UDF superblock/private state.

Reproducer:

syz reproducer: https://pastebin.com/raw/MKi2B5eM
console output: https://pastebin.com/raw/z6SbDFgb
kernel config: https://pastebin.com/raw/AC6Cwmzt

Kernel:

HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

BUG: unable to handle page fault for address: ffffed1020a13763
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 10381 Comm: syz-executor Not tainted 7.2.0-rc3 #1
PREEMPT(full)
Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996)

RIP: 0010:udf_add_fid_counter+0x22b/0x2d0

Call Trace:
 <TASK>
 udf_unlink+0x2e3/0x4a0
 vfs_unlink+0x2fc/0xc10
 filename_unlinkat+0x3b6/0x560
 __x64_sys_unlink+0x46/0x70
 do_syscall_64+0xc4/0x7a0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>

CR2: ffffed1020a13763
Kernel panic - not syncing: Fatal exception