For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] jffs2: fix double-free of f->target in jffs2_alloc_inode()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


jffs2_alloc_inode() does not initialize f->target before returning
the new inode. It is normally cleared later by
jffs2_init_inode_info(), called from jffs2_iget(), but that runs
only after alloc_inode() has already returned successfully.

If inode_init_always() fails in between, alloc_inode() calls
->free_inode() directly on the half-initialized inode.
jffs2_free_inode() then does kfree(f->target) on whatever stale
value was left in the reused slab object, which can be a pointer
that was already freed, causing a double-free.

Initialize f->target to NULL in jffs2_alloc_inode() to close this
window.

Reported-by: syzbot+675e84fdf3dde67b4946@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=675e84fdf3dde67b4946
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/jffs2/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 81396a092ba8..3c32d5c776e1 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -42,6 +42,7 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
 	f = alloc_inode_sb(sb, jffs2_inode_cachep, GFP_KERNEL);
 	if (!f)
 		return NULL;
+	f->target = NULL;
 	return &f->vfs_inode;
 }
 
-- 
2.34.1