android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

udf: Fix error handling in udf_new_inode()

Browse Source 
[ Upstream commit f05f2429eec60851b98bdde213de31dab697c01b ]

When memory allocation of iinfo or block allocation fails, already
allocated struct udf_inode_info gets freed with iput() and
udf_evict_inode() may look at inode fields which are not properly
initialized. Fix it by marking inode bad before dropping reference to it
in udf_new_inode().

Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jan Kara 2021-12-14 11:04:29 +01:00 committed by Greg Kroah-Hartman
parent 15be042e7f
commit ce34b03a71
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/udf/ialloc.c
View File

@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
GFP_KERNEL); GFP_KERNEL);
} }
if (!iinfo->i_data) { if (!iinfo->i_data) {
make_bad_inode(inode);
iput(inode); iput(inode);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
dinfo->i_location.partitionReferenceNum, dinfo->i_location.partitionReferenceNum,
start, &err); start, &err);
if (err) { if (err) {
make_bad_inode(inode);
iput(inode); iput(inode);
return ERR_PTR(err); return ERR_PTR(err);
} }