udf: Fix error handling in udf_new_inode()
authorJan Kara <jack@suse.cz>
Tue, 14 Dec 2021 10:04:29 +0000 (11:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jan 2022 09:54:23 +0000 (10:54 +0100)
commitce34b03a71b62b273e9fb7eb314ac417efb1a427
tree257b6912de8bda9871c9117a77d789d3a2e24268
parent15be042e7fd9295d32c6104088fb4351519097c6
udf: Fix error handling in udf_new_inode()

[ Upstream commit f05f2429eec60851b98bdde213de31dab697c01b ]

When memory allocation of iinfo or block allocation fails, already
allocated struct udf_inode_info gets freed with iput() and
udf_evict_inode() may look at inode fields which are not properly
initialized. Fix it by marking inode bad before dropping reference to it
in udf_new_inode().

Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/udf/ialloc.c