summaryrefslogtreecommitdiffstats
path: root/fs/udf
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2021-12-14 11:04:29 +0100
committerJan Kara <jack@suse.cz>2021-12-15 13:08:34 +0100
commitf05f2429eec60851b98bdde213de31dab697c01b (patch)
treea235301c82f3a64a4105441286f5800f7a4f54cb /fs/udf
parentreiserfs: don't use congestion_wait() (diff)
downloadlinux-f05f2429eec60851b98bdde213de31dab697c01b.tar.xz
linux-f05f2429eec60851b98bdde213de31dab697c01b.zip
udf: Fix error handling in udf_new_inode()
When memory allocation of iinfo or block allocation fails, already allocated struct udf_inode_info gets freed with iput() and udf_evict_inode() may look at inode fields which are not properly initialized. Fix it by marking inode bad before dropping reference to it in udf_new_inode(). Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/udf')
-rw-r--r--fs/udf/ialloc.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 2ecf0e87660e..b5d611cee749 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
GFP_KERNEL);
}
if (!iinfo->i_data) {
+ make_bad_inode(inode);
iput(inode);
return ERR_PTR(-ENOMEM);
}
@@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
dinfo->i_location.partitionReferenceNum,
start, &err);
if (err) {
+ make_bad_inode(inode);
iput(inode);
return ERR_PTR(err);
}