[PATCH] jffs2: initialize f->inocache to NULL in jffs2_init_inode_info()

[Shuai Liu]

new_inode() can hand back a jffs2_inode_info recycled from slab with a
stale f->inocache still pointing to a jffs2_inode_cache that was freed
by a previous mount's jffs2_free_ino_caches().  jffs2_init_inode_info()
initialises every other pointer field but leaves f->inocache untouched.

If jffs2_new_inode() then fails before jffs2_do_new_inode() assigns a
fresh f->inocache -- e.g. in jffs2_init_acl_pre() -- the error path does
make_bad_inode() + iput(), and evict() ends up calling
jffs2_xattr_delete_inode() which dereferences the stale pointer when
reading ic->pino_nlink, causing a slab-use-after-free:

  BUG: KASAN: slab-use-after-free in jffs2_xattr_delete_inode
  Read of size 4 at addr ... by task repro
    jffs2_xattr_delete_inode
    jffs2_do_clear_inode
    evict
    jffs2_new_inode
    jffs2_mkdir
  Allocated by jffs2_scan_make_ino_cache (jffs2_do_mount_fs)
  Freed by jffs2_free_ino_caches (jffs2_put_super)

Fix by clearing f->inocache in jffs2_init_inode_info(), consistent with
the other pointer fields there.  Verified with the syzbot C reproducer
under QEMU with KASAN: the UAF is reported before the patch and absent
after it.

Originally proposed by Lucas Jeffrey <luquijeffrey@xxxxxxxxx>
(Link: https://lore.kernel.org/all/20260909023955.1642244-1-luquijeffrey@xxxxxxxxx/);
that thread has seen no activity since September 10 while the bug is
still reproducing upstream, so resubmitting with his credit.

Reported-by: syzbot+3a8099322b09d8d073d1@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=3a8099322b09d8d073d1
Suggested-by: Lucas Jeffrey <luquijeffrey@xxxxxxxxx>
Signed-off-by: Shuai Liu <847807867@xxxxxx>
---
 fs/jffs2/os-linux.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/jffs2/os-linux.h b/fs/jffs2/os-linux.h
index bff2134d771d..e80b786c9ea2 100644
--- a/fs/jffs2/os-linux.h
+++ b/fs/jffs2/os-linux.h
@@ -55,6 +55,7 @@ static inline void jffs2_init_inode_info(struct jffs2_inode_info *f)
 	f->metadata = NULL;
 	f->dents = NULL;
 	f->target = NULL;
+	f->inocache = NULL;
 	f->flags = 0;
 	f->usercompr = 0;
 }
-- 
2.43.0