Re: [PATCH] jfs: fix double free of the log superblock buffer in lmLogInit()

[Shuai Liu]

Hi Aleksandr,

I ran into the same double free while triaging a syzbot report, and I can
confirm both the analysis and the fix.

The report is this one:

  https://syzkaller.appspot.com/bug?extid=d16facb00df3f446511c
  KASAN: slab-use-after-free Read in lmLogInit

It is the same bug: the second lbmFree(bpsuper) makes log->lbuf_free
circular, and lbmLogShutdown() then walks that list and reads l_freelist
from an lbuf it has already kfree()d.

On a v7.3 based tree with KASAN, using the syzbot C reproducer (crafted
JFS image mounted through a loop device), the unpatched kernel gives:

  BUG: KASAN: slab-use-after-free in lmLogInit+0x146b/0x17e0
  Read of size 8 at addr ffff88802e805c18 by task exploit/10730
  ...
  lmLogInit
  lmLogOpen
  jfs_mount_rw
  jfs_reconfigure
  mount

With your patch applied on top of 4ce61d7abd85, the same reproducer
reaches the error path (lmLogInit: exit(-5), i.e. -EIO from the log
superblock write) and there is no KASAN report at all; the machine then
powers off normally.

Tested-by: Shuai Liu <847807867@xxxxxx>

One minor nit on the changelog: it says lbmLogShutdown() "never
terminates". In my run the first visible symptom is the KASAN
use-after-free read inside that loop; the endless loop is the same
circular list, just without KASAN's quarantine. Not worth a respin on its
own, I think.

Dave, this has been on the list since August without a reply - could you
take a look?

Thanks,
Shuai