lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 431/563] udf: Fix error handling in udf_new_inode()
    Date
    From: Jan Kara <jack@suse.cz>

    [ Upstream commit f05f2429eec60851b98bdde213de31dab697c01b ]

    When memory allocation of iinfo or block allocation fails, already
    allocated struct udf_inode_info gets freed with iput() and
    udf_evict_inode() may look at inode fields which are not properly
    initialized. Fix it by marking inode bad before dropping reference to it
    in udf_new_inode().

    Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/udf/ialloc.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
    index 84ed23edebfd3..87a77bf70ee19 100644
    --- a/fs/udf/ialloc.c
    +++ b/fs/udf/ialloc.c
    @@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
    GFP_KERNEL);
    }
    if (!iinfo->i_data) {
    + make_bad_inode(inode);
    iput(inode);
    return ERR_PTR(-ENOMEM);
    }
    @@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
    dinfo->i_location.partitionReferenceNum,
    start, &err);
    if (err) {
    + make_bad_inode(inode);
    iput(inode);
    return ERR_PTR(err);
    }
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 21:24    [W:4.030 / U:1.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site