diff options
| author | Jan Kara <jack@suse.cz> | 2021-12-14 11:04:29 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-01-27 10:54:23 +0100 |
| commit | ce34b03a71b62b273e9fb7eb314ac417efb1a427 (patch) | |
| tree | 257b6912de8bda9871c9117a77d789d3a2e24268 /fs/udf | |
| parent | 15be042e7fd9295d32c6104088fb4351519097c6 (diff) | |
udf: Fix error handling in udf_new_inode()
[ Upstream commit f05f2429eec60851b98bdde213de31dab697c01b ]
When memory allocation of iinfo or block allocation fails, already
allocated struct udf_inode_info gets freed with iput() and
udf_evict_inode() may look at inode fields which are not properly
initialized. Fix it by marking inode bad before dropping reference to it
in udf_new_inode().
Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/udf')
| -rw-r--r-- | fs/udf/ialloc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c index 84ed23edebfd..87a77bf70ee1 100644 --- a/fs/udf/ialloc.c +++ b/fs/udf/ialloc.c @@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode) GFP_KERNEL); } if (!iinfo->i_data) { + make_bad_inode(inode); iput(inode); return ERR_PTR(-ENOMEM); } @@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode) dinfo->i_location.partitionReferenceNum, start, &err); if (err) { + make_bad_inode(inode); iput(inode); return ERR_PTR(err); } |