[PATCH v2] jffs2: initialize inocache and target to NULL when allocating and initializing an jffs2_inode_info

[Lucas Jeffrey]

When a jffs2_inode_info is allocated via new_inode(), due to memory reuse it
can retain stale values from its previous use.

If the new jffs2_inode_info object allocated retains an old reference to a
freed inocache, the function jffs2_new_inode may crash if either
jffs2_init_acl_pre or jffs2_do_new_inode returns an error value because
when calling iput() with the inode it will eventually attempt to free again
the inocache.

There is another failure path which is, if target is not null when allocating
the object in jffs2_alloc_inode, and immediately after returning the newly allocated object,
and if the 'inode_init_always' returns an error value (allocation failure for example)
then the vfs will attempt to free the inode and jffs2_free_inode will attempt to free f->target,
which can be a stale value from a previous allocation, generating a double free/use after free.

Reported-by: syzbot+3a8099322b09d8d073d1@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=3a8099322b09d8d073d1
Signed-off-by: Lucas Jeffrey <luquijeffrey@xxxxxxxxx>

---

Changes in V2: initializing target field to NULL in jffs2_alloc_inode
---
 fs/jffs2/os-linux.h | 1 +
 fs/jffs2/super.c    | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/fs/jffs2/os-linux.h b/fs/jffs2/os-linux.h
index 86ab014a349c..40f17218a276 100644
--- a/fs/jffs2/os-linux.h
+++ b/fs/jffs2/os-linux.h
@@ -52,6 +52,7 @@ static inline void jffs2_init_inode_info(struct jffs2_inode_info *f)
 {
 	f->highest_version = 0;
 	f->fragtree = RB_ROOT;
+	f->inocache = NULL;
 	f->metadata = NULL;
 	f->dents = NULL;
 	f->target = NULL;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 81396a092ba8..2343c21b49e6 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -42,6 +42,8 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
 	f = alloc_inode_sb(sb, jffs2_inode_cachep, GFP_KERNEL);
 	if (!f)
 		return NULL;
+
+	f->target = NULL;
 	return &f->vfs_inode;
 }
 
-- 
2.43.0