[PATCH 2/2] fs: jffs2: don't free the symlink target twice

[Sascha Hauer <s.hauer@pengutronix.de>]

jffs2_iget() makes f->target the inode's i_link for symlinks. Since
commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
destroying an inode, and jffs2_destroy_inode() then frees f->target
again, so unmounting a JFFS2 that had a symlink looked up ends in a
double free.

Hand the target over to the VFS by clearing f->target once it is the
inode's i_link. Nothing else reads f->target after jffs2_iget().

Fixes: 66666e887c ("fs: free inode->i_link")
Assisted-by: Claude:claude-opus-5-5
---
 fs/jffs2/fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 84f39a0f2a..1a125f9185 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -181,7 +181,9 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
 
 	case S_IFLNK:
 		inode->i_op = &simple_symlink_inode_operations;
+		/* the VFS frees i_link when destroying the inode */
 		inode->i_link = f->target;
+		f->target = NULL;
 		break;
 
 	case S_IFDIR:
-- 
2.47.3