Re: [PATCH] ocfs2: Fix use-after-free in ocfs2_dx_dir_lookup_rec

[Joseph Qi <joseph.qi@linux.alibaba.com>]

Hi,
This seems to be fixed by the following commit:
44acc46d182f ocfs2: avoid NULL pointer dereference in dx_dir_lookup_rec()

Thanks,
Joseph

On 2025/10/5 23:14, ssrane_b23@ee.vjti.ac.in wrote:
> From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> 
> A syzbot report triggered a KASAN use-after-free read when creating a
> file on a corrupted OCFS2 filesystem image.
> 
> The crash occurs in an error-handling path within the
> ocfs2_dx_dir_lookup_rec function. When the function fails to find a
> matching extent record (`found` is false), it attempts to log details
> about the corruption by reading from the `rec` variable.
> 
> According to the KASAN report, the memory pointed to by `rec` can be
> invalid at this point, leading to a kernel crash.
> 
> Fix this by modifying the error message to use only variables that are
> known to be safe, such as the inode number and the extent block's
> buffer head block number. This preserves the valuable error log for
> debugging corrupted filesystems while preventing the memory safety
> violation.
> 
> Reported-by: syzbot+30b53487d00b4f7f0922@syzkaller.appspotmail.com
> Tested-by: syzbot+30b53487d00b4f7f0922@syzkaller.appspotmail.com
> Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> ---
>  fs/ocfs2/dir.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
> index 8c9c4825f984..8c4dd61efa8d 100644
> --- a/fs/ocfs2/dir.c
> +++ b/fs/ocfs2/dir.c
> @@ -820,8 +820,7 @@ static int ocfs2_dx_dir_lookup_rec(struct inode *inode,
>  		ret = ocfs2_error(inode->i_sb,
>  				  "Inode %lu has bad extent record (%u, %u, 0) in btree\n",
>  				  inode->i_ino,
> -				  le32_to_cpu(rec->e_cpos),
> -				  ocfs2_rec_clusters(el, rec));
> +				  eb_bh ? (unsigned long long)eb_bh->b_blocknr : 0);
>  		goto out;
>  	}
>