Commit f05f2429 authored by Jan Kara's avatar Jan Kara
Browse files

udf: Fix error handling in udf_new_inode() 



When memory allocation of iinfo or block allocation fails, already
allocated struct udf_inode_info gets freed with iput() and
udf_evict_inode() may look at inode fields which are not properly
initialized. Fix it by marking inode bad before dropping reference to it
in udf_new_inode().

Reported-by: default avatar <syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent b831281b

fs/udf/ialloc.c

+2 −0
Original line number Diff line number Diff line
@@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode) 
					GFP_KERNEL);

	}

	if (!iinfo->i_data) {

		make_bad_inode(inode);

		iput(inode);

		return ERR_PTR(-ENOMEM);

	}
@@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode) 
			      dinfo->i_location.partitionReferenceNum,

			      start, &err);

	if (err) {

		make_bad_inode(inode);

		iput(inode);

		return ERR_PTR(err);

	}