For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] jffs2: replace BUG_ON with warning in
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 jffs2_del_ino_cache

jffs2_del_ino_cache() panics the kernel via BUG_ON if the inode cache
entry still has xattr references:

    BUG_ON(old->xref);

This can be triggered by a crafted JFFS2 image where the CRC check
path calls jffs2_do_clear_inode() while pino_nlink is non-zero.
jffs2_xattr_delete_inode() skips cleanup when pino_nlink > 0, so the
xref list survives into jffs2_del_ino_cache(), hitting the BUG_ON.

Replace the BUG_ON with WARN_ON_ONCE to report the inconsistency
without crashing the kernel.  The leaked xrefs will be cleaned up
when the filesystem is unmounted via jffs2_free_ino_caches().

Reported-by: syzbot+44664704c1494ad5f7a0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=44664704c1494ad5f7a0
Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version 5)")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/jffs2/nodelist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -459,7 +459,7 @@ void jffs2_del_ino_cache(struct jffs2_sb_info *c, struct jffs2_inode_cache *old)
 	struct jffs2_inode_cache **prev;

 #ifdef CONFIG_JFFS2_FS_XATTR
-	BUG_ON(old->xref);
+	WARN_ON_ONCE(old->xref);
 #endif
 	dbg_inocache("del %p (ino #%u)\n", old, old->ino);
 	spin_lock(&c->inocache_lock);
--
2.43.0