CVE-2025-38328

In the Linux kernel, the following vulnerability has been resolved:

jffs2: check jffs2preallocrawnoderefs() result in few other places

Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2preallocrawnoderefs() completed successfully. Subsequent logic implies that the node refs have been allocated.

Handle that. The code is ready for propagating the error upwards.

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2linknoderef+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace: jffs2markerasedblock fs/jffs2/erase.c:460 [inline] jffs2erasependingblocks+0x688/0x1860 fs/jffs2/erase.c:118 jffs2garbagecollectpass+0x638/0x1a00 fs/jffs2/gc.c:253 jffs2reservespace+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167 jffs2writeinoderange+0x246/0xb50 fs/jffs2/write.c:362 jffs2writeend+0x712/0x1110 fs/jffs2/file.c:302 genericperformwrite+0x2c2/0x500 mm/filemap.c:3347 _genericfilewriteiter+0x252/0x610 mm/filemap.c:3465 genericfilewriteiter+0xdb/0x230 mm/filemap.c:3497 callwriteiter include/linux/fs.h:2039 [inline] doiterreadvwritev+0x46d/0x750 fs/readwrite.c:740 doiterwrite+0x18c/0x710 fs/readwrite.c:866 vfswritev+0x1db/0x6a0 fs/readwrite.c:939 dopwritev fs/readwrite.c:1036 [inline] _dosyspwritev fs/readwrite.c:1083 [inline] _sesyspwritev fs/readwrite.c:1078 [inline] _x64syspwritev+0x235/0x310 fs/readwrite.c:1078 dosyscall64+0x30/0x40 arch/x86/entry/common.c:46 entrySYSCALL64after_hwframe+0x67/0xd1

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.