AW: [PATCH] jffs: initialize inocache to NULL when initializing a jffs2_inode_info

[Richard Weinberger]

Am Wed, Sep 9, 2026, 04:40 schrieb Lucas Jeffrey <luquijeffrey at gmail.com>:

> When a jffs2_inode_info is allocated via new_inode(), due to memory reuse it
> can retain stale values from its previous use.
> 
> If the new jffs2_inode_info object allocated retains an old reference to a
> freed inocache, the function jffs2_new_inode may crash if either
> jffs2_init_acl_pre or jffs2_do_new_inode returns an error value because
> when calling iput() with the inode it will eventually attempt to free again
> the inocache.
> 
> Reported-by: syzbot+3a8099322b09d8d073d1 at syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3a8099322b09d8d073d1
> Signed-off-by: Lucas Jeffrey <luquijeffrey at gmail.com>

This was reported earlier but the reporter went silent.
https://lore.kernel.org/linux-mtd/849183271.921.1787173413104.JavaMail.zimbra@nod.at/

Thanks,
//richard