tree a3336c1a307df071e9d02057988c53ac0566067a
parent 74ecdda68242b174920fe7c6133a856fb7d8559b
author Edward Adam Davis <eadavis@qq.com> 1698730744 +0800
committer Dave Kleikamp <dave.kleikamp@oracle.com> 1700601993 -0600

jfs: fix uaf in jfs_evict_inode

When the execution of diMount(ipimap) fails, the object ipimap that has been
released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs
when rcu_core() calls jfs_free_node().

Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as
ipimap.

Reported-and-tested-by: syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>