ocfs2_init_global_system_inodes() installs osb->root_inode before the
second ocfs2_iget() runs, and when that iget fails ocfs2_initialize_super()
jumps to out_dlm_out, which sits below out_system_inodes, so
ocfs2_release_system_inodes() never runs and the kfree(osb) that follows
makes the stranded root inode reference unreachable.  ocfs2_fill_super()
strands the same inode a second way: nothing drops the reference igrab()
takes on osb->root_inode when an out_dismount path ahead of d_make_root()
is taken, so the ocfs2_release_system_inodes() call inside
ocfs2_dismount_volume() cannot free it and the root inode stays hashed on a
superblock whose ocfs2_super has already been freed.  The reported KASAN
slab-use-after-free write hits an ocfs2_inode_cache object that
ocfs2_release_system_inodes() freed during teardown, so an ocfs2 inode
reference that survives that call is a lifetime error on those same objects
and not a bare leak.  Release the system inodes at that failing
ocfs2_iget() and drop the igrab() reference on out_dismount, clearing inode
right after d_make_root(), which consumes it on success and on failure
alike, so it cannot be dropped twice.

Closes: https://lore.kernel.org/all/CA+0ovCjAKQMn7iF8BJR-3+G9_HBRnRFtJxjr-9P9GuKSxFj+3Q@mail.gmail.com/
Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
---
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -450,6 +450,7 @@ static int ocfs2_init_global_system_inodes(struct
ocfs2_super *osb)
 	if (IS_ERR(new)) {
 		status = PTR_ERR(new);
 		mlog_errno(status);
+		ocfs2_release_system_inodes(osb);
 		goto bail;
 	}
 	osb->sys_root_inode = new;
@@ -1110,6 +1111,8 @@ static int ocfs2_fill_super(struct super_block
*sb, struct fs_context *fc)
 	}

 	root = d_make_root(inode);
+	/* d_make_root() consumed our reference, on success and on failure. */
+	inode = NULL;
 	if (!root) {
 		status = -ENOMEM;
 		goto out_dismount;
@@ -1163,6 +1166,7 @@ out_dismount:
 	atomic_set(&osb->vol_state, VOLUME_DISABLED);
 	wake_up(&osb->osb_mount_event);
 	ocfs2_free_replay_slots(osb);
+	iput(inode);
 	ocfs2_dismount_volume(sb, 1);
 	goto out;

On 9/11/26 5:47 AM, Farhad Alemi wrote:
> ocfs2_init_global_system_inodes() installs osb->root_inode before the
> second ocfs2_iget() runs, and when that iget fails ocfs2_initialize_super()
> jumps to out_dlm_out, which sits below out_system_inodes, so
> ocfs2_release_system_inodes() never runs and the kfree(osb) that follows
> makes the stranded root inode reference unreachable.  ocfs2_fill_super()
> strands the same inode a second way: nothing drops the reference igrab()
> takes on osb->root_inode when an out_dismount path ahead of d_make_root()
> is taken, so the ocfs2_release_system_inodes() call inside
> ocfs2_dismount_volume() cannot free it and the root inode stays hashed on a
> superblock whose ocfs2_super has already been freed.  The reported KASAN
> slab-use-after-free write hits an ocfs2_inode_cache object that
> ocfs2_release_system_inodes() freed during teardown, so an ocfs2 inode
> reference that survives that call is a lifetime error on those same objects
> and not a bare leak.  Release the system inodes at that failing
> ocfs2_iget() and drop the igrab() reference on out_dismount, clearing inode
> right after d_make_root(), which consumes it on success and on failure
> alike, so it cannot be dropped twice.
> 
> Closes: https://lore.kernel.org/all/CA+0ovCjAKQMn7iF8BJR-3+G9_HBRnRFtJxjr-9P9GuKSxFj+3Q@mail.gmail.com/
> Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> ---
> --- a/fs/ocfs2/super.c
> +++ b/fs/ocfs2/super.c

Seems it is a corrupt patch?

> @@ -450,6 +450,7 @@ static int ocfs2_init_global_system_inodes(struct
> ocfs2_super *osb)
>  	if (IS_ERR(new)) {
>  		status = PTR_ERR(new);
>  		mlog_errno(status);
> +		ocfs2_release_system_inodes(osb);
>  		goto bail;
>  	}
>  	osb->sys_root_inode = new;
> @@ -1110,6 +1111,8 @@ static int ocfs2_fill_super(struct super_block
> *sb, struct fs_context *fc)
>  	}
> 
>  	root = d_make_root(inode);
> +	/* d_make_root() consumed our reference, on success and on failure. */
> +	inode = NULL;
>  	if (!root) {
>  		status = -ENOMEM;
>  		goto out_dismount;
> @@ -1163,6 +1166,7 @@ out_dismount:
>  	atomic_set(&osb->vol_state, VOLUME_DISABLED);
>  	wake_up(&osb->osb_mount_event);
>  	ocfs2_free_replay_slots(osb);

Please rebase on top of the latest linux-next.
The above 'ocfs2_free_replay_slots(osb)' is removed.

Thanks,
Joseph

> +	iput(inode);
>  	ocfs2_dismount_volume(sb, 1);
>  	goto out;