[PATCH 1/2] fs: ubifs: don't free the symlink target twice

[Sascha Hauer]

On Mon, 02 Nov 2026 15:53:01 +0100, Sascha Hauer wrote:
> ubifs_iget() makes ui->data the inode's i_link for symlinks. Since
> commit 66666e887c ("fs: free inode->i_link") the VFS frees i_link when
> destroying an inode, and ubifs_destroy_inode() then frees ui->data
> again. Unmounting a UBIFS that had a symlink looked up thus ends in a
> double free:
> 
>   !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
>   ...
>   (ubifs_destroy_inode+0x18/0x2c) from (destroy_inode+0x38/0x4c)
> 
> [...]

Applied, thanks!

[1/2] fs: ubifs: don't free the symlink target twice
      https://git.pengutronix.de/cgit/barebox/commit/?id=0d77ce844730 (link may not be stable)
[2/2] fs: jffs2: don't free the symlink target twice
      https://git.pengutronix.de/cgit/barebox/commit/?id=ba365e56c385 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer at pengutronix.de>