[PATCH 1/2] fs: ubifs: don't free the symlink target twice

[PATCH 1/2] fs: ubifs: don't free the symlink target twice

[Sascha Hauer]

ubifs_iget() makes ui->data the inode's i_link for symlinks. Since
commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
destroying an inode, and ubifs_destroy_inode() then frees ui->data
again. Unmounting a UBIFS that had a symlink looked up thus ends in a
double free:

  !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
  ...
  (ubifs_destroy_inode+0x18/0x2c) from (destroy_inode+0x38/0x4c)

Hand the target over to the VFS by clearing ui->data once it is the
inode's i_link.

Fixes: 66666e887c ("fs: free inode->i_link")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 fs/ubifs/super.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8eb8e574a8..30f2c03e69 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -211,7 +211,9 @@ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum)
 		}
 		memcpy(ui->data, ino->data, ui->data_len);
 		((char *)ui->data)[ui->data_len] = '\0';
+		/* the VFS frees i_link when destroying the inode */
 		inode->i_link = ui->data;
+		ui->data = NULL;
 		break;
 	case S_IFBLK:
 	case S_IFCHR:
-- 
2.47.3

[PATCH 2/2] fs: jffs2: don't free the symlink target twice

[Sascha Hauer]

jffs2_iget() makes f->target the inode's i_link for symlinks. Since
commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
destroying an inode, and jffs2_destroy_inode() then frees f->target
again, so unmounting a JFFS2 that had a symlink looked up ends in a
double free.

Hand the target over to the VFS by clearing f->target once it is the
inode's i_link. Nothing else reads f->target after jffs2_iget().

Fixes: 66666e887c ("fs: free inode->i_link")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 fs/jffs2/fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 84f39a0f2a..1a125f9185 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -181,7 +181,9 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
 
 	case S_IFLNK:
 		inode->i_op = &simple_symlink_inode_operations;
+		/* the VFS frees i_link when destroying the inode */
 		inode->i_link = f->target;
+		f->target = NULL;
 		break;
 
 	case S_IFDIR:
-- 
2.47.3

Re: [PATCH 1/2] fs: ubifs: don't free the symlink target twice

[Sascha Hauer]

On Mon, 02 Nov 2026 15:53:01 +0100, Sascha Hauer wrote:
> ubifs_iget() makes ui->data the inode's i_link for symlinks. Since
> commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
> destroying an inode, and ubifs_destroy_inode() then frees ui->data
> again. Unmounting a UBIFS that had a symlink looked up thus ends in a
> double free:
> 
>   !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
>   ...
>   (ubifs_destroy_inode+0x18/0x2c) from (destroy_inode+0x38/0x4c)
> 
> [...]

Applied, thanks!

[1/2] fs: ubifs: don't free the symlink target twice
      https://git.pengutronix.de/cgit/barebox/commit/?id=0d77ce844730 (link may not be stable)
[2/2] fs: jffs2: don't free the symlink target twice
      https://git.pengutronix.de/cgit/barebox/commit/?id=ba365e56c385 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>

[PATCH 1/2] fs: ubifs: don't free the symlink target twice

[Sascha Hauer]

ubifs_iget() makes ui->data the inode's i_link for symlinks. Since
commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
destroying an inode, and ubifs_destroy_inode() then frees ui->data
again. Unmounting a UBIFS that had a symlink looked up thus ends in a
double free:

  !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
  ...
  (ubifs_destroy_inode+0x18/0x2c) from (destroy_inode+0x38/0x4c)

Hand the target over to the VFS by clearing ui->data once it is the
inode's i_link.

Fixes: 66666e887c ("fs: free inode->i_link")
Assisted-by: Claude:claude-opus-5-5
---
 fs/ubifs/super.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8eb8e574a8..30f2c03e69 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -211,7 +211,9 @@ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum)
 		}
 		memcpy(ui->data, ino->data, ui->data_len);
 		((char *)ui->data)[ui->data_len] = '\0';
+		/* the VFS frees i_link when destroying the inode */
 		inode->i_link = ui->data;
+		ui->data = NULL;
 		break;
 	case S_IFBLK:
 	case S_IFCHR:
-- 
2.47.3