Two robustness fixes for the ufs mount path, both reachable by mounting
a crafted UFS image.

Patch 1 reorders ufs_fill_super() so the root dentry is created after the
cylinder group metadata is loaded. Today a failure while reading the
cylinder groups drops UFS_SB(sb) but leaves s_root installed, so the
generic teardown oopses on a NULL pointer in ufs_sync_fs() and the
put_super operation.

Patch 2 validates the cylinder group index and the rotor positions in
ufs_read_cylinder() before they are cached. Unchecked, c_cgx indexes the
cylinder summary array (a 32 bit write outside s_csp), and the rotors
become bitmap scan offsets that can wrap an unsigned length and walk past
the cylinder group buffers during an ordinary allocation.

Mounting a ufs image needs CAP_SYS_ADMIN and ufs is not
unprivileged-mountable, so this is image-parsing hardening rather than a
privilege boundary, handled in the open like the recent sibling work:

  ufs: reject malformed cylinder summary geometry
    https://lore.kernel.org/all/20260701215700.822003-1-kudo3228@gmail.com/
  ufs: reject oversized cylinder group metadata
    https://lore.kernel.org/all/20260717104033.38574-1-david.lee@trailofbits.com/

Those validate fs_cssize and fs_cgsize in ufs_fill_super(); the checks
here live in ufs_read_cylinder() and do not overlap with them.

Both were reproduced under KASAN on an unpatched kernel by mounting a
crafted UFS2 image.

Patch 1, an image whose first cylinder group fails the magic check, so
ufs_read_cylinder_structures() fails after the root dentry is installed:

  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
   ufs_sync_fs+0x5b/0x6d0
  BUG: kernel NULL pointer dereference, address: 0000000000000100

Patch 2, an image whose on-disk cg_cgx is out of range, followed by a
write that allocates a block:

  BUG: KASAN: slab-out-of-bounds in adjust_free_blocks+0x1bf0/0x2510
   adjust_free_blocks

With the patches applied, patch 1 loads the cylinder groups before
publishing the root dentry and patch 2 rejects the mismatched cg_cgx in
ufs_read_cylinder(), so neither faulting access is reached.

Ali Ahmet Memis (2):
  ufs: create the root dentry after loading cylinder metadata
  ufs: validate cylinder group metadata before caching it

 fs/ufs/cylinder.c | 10 ++++++++++
 fs/ufs/super.c    | 17 +++++++++--------
 2 files changed, 19 insertions(+), 8 deletions(-)

-- 
2.54.0

On Sat, 01 Aug 2026 10:12:56 +0300, Ali Ahmet Memis wrote:
> Two robustness fixes for the ufs mount path, both reachable by mounting
> a crafted UFS image.
> 
> Patch 1 reorders ufs_fill_super() so the root dentry is created after the
> cylinder group metadata is loaded. Today a failure while reading the
> cylinder groups drops UFS_SB(sb) but leaves s_root installed, so the
> generic teardown oopses on a NULL pointer in ufs_sync_fs() and the
> put_super operation.
> 
> [...]

In the future, please cut down and rewrite LLM generated cover letters and
commit messages.

---

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/2] ufs: create the root dentry after loading cylinder metadata
      https://git.kernel.org/vfs/vfs/c/55a4c98abb96
[2/2] ufs: validate cylinder group metadata before caching it
      https://git.kernel.org/vfs/vfs/c/c9d263be2680

On Tue, 25 Aug 2026, Christian Brauner wrote:
> In the future, please cut down and rewrite LLM generated cover letters and
> commit messages.

Thanks for applying these. I wrote them myself (English isn't my first language, so I guess that can make them sound a bit artificial) but I'll keep the
commit messages and cover letters shorter next time.