Re: [BUG] udf: possible use-after-free in udf_close_lvid

[Jan Kara]

Hello!

On Thu 03-09-26 15:14:26, CJ wrote:
> I am reporting that use-after-free in udf_close_lvid appears to remain
> reproducible with a migrated syzkaller reproducer on Linux 7.2-rc3. The
> tested HEAD commit is a13c140cc289c0b7b3770bce5b3ad42ab35074aa.

You can try with linux-next. I have queued one UDF fix for incorrect LVID
handling.

> The reproducer mounts and unmounts a crafted UDF image, reaching
> udf_put_super() and udf_close_lvid() during superblock teardown.

I'm sorry but I don't have capacity to address all these "maliciously
corrupted image causes issues" bugs and I'm even less willing to run random
code fetched from pastebin.com. If the report is from official syzbot
instance, I might have a look on time-permitting basis. BTW the syzbot
report you reference below has long been fixed so that's a different bug
(although a similar backtrace).

								Honza

> The target run faults in udf_close_lvid(), while the structurally matching
> archived report identifies a use-after-free write in the same function and
> teardown path.
> 
> 
> This looks like lifetime or teardown ordering around the logical volume
> integrity descriptor, allowing udf_close_lvid() to access storage that has
> already been released.
> 
> 
> This issue was previously reported at:
> 
> 
> https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d
> 
> 
> Reproducer:
> 
> 
> syz reproducer:https://pastebin.com/raw/TS2t3YbZ
> 
> 
> console output: https://pastebin.com/raw/F3Kw8uUb
> kernel config: https://pastebin.com/raw/8dTgtKu5
> 
> 
> Kernel:
> 
> 
> HEAD commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
> git tree: torvalds/linux
> kernel version: 7.2.0-rc3 #1 PREEMPT(full)
> tested tag: v7.2-rc3
> 
> 
> Let me know if you need more details or testing.
> 
> 
> Best regards
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR