[BUG] udf: possible use-after-free in udf_close_lvid

[CJ]

Hi,


I am reporting that use-after-free in udf_close_lvid appears to remain
reproducible with a migrated syzkaller reproducer on Linux 7.2-rc3. The
tested HEAD commit is a13c140cc289c0b7b3770bce5b3ad42ab35074aa.


The reproducer mounts and unmounts a crafted UDF image, reaching
udf_put_super() and udf_close_lvid() during superblock teardown.


The target run faults in udf_close_lvid(), while the structurally matching
archived report identifies a use-after-free write in the same function and
teardown path.


This looks like lifetime or teardown ordering around the logical volume
integrity descriptor, allowing udf_close_lvid() to access storage that has
already been released.


This issue was previously reported at:


https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d


Reproducer:


syz reproducer:https://pastebin.com/raw/TS2t3YbZ


console output: https://pastebin.com/raw/F3Kw8uUb
kernel config: https://pastebin.com/raw/8dTgtKu5


Kernel:


HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full)
tested tag: v7.2-rc3


Let me know if you need more details or testing.


Best regards