[PATCH 1/2] fs: ubifs: don't free the symlink target twice

[Sascha Hauer]

ubifs_iget() makes ui->data the inode's i_link for symlinks. Since
commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
destroying an inode, and ubifs_destroy_inode() then frees ui->data
again. Unmounting a UBIFS that had a symlink looked up thus ends in a
double free:

  !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
  ...
  (ubifs_destroy_inode+0x18/0x2c) from (destroy_inode+0x38/0x4c)

Hand the target over to the VFS by clearing ui->data once it is the
inode's i_link.

Fixes: 66666e887c ("fs: free inode->i_link")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
---
 fs/ubifs/super.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8eb8e574a8..30f2c03e69 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -211,7 +211,9 @@ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum)
 		}
 		memcpy(ui->data, ino->data, ui->data_len);
 		((char *)ui->data)[ui->data_len] = '\0';
+		/* the VFS frees i_link when destroying the inode */
 		inode->i_link = ui->data;
+		ui->data = NULL;
 		break;
 	case S_IFBLK:
 	case S_IFCHR:
-- 
2.47.3