From: Jan Kara <jack@suse.cz>
Date: Tue, 14 Dec 2021 10:04:29 +0000 (+0100)
Subject: udf: Fix error handling in udf_new_inode()
X-Git-Tag: v6.6.17~8425^2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f05f2429eec60851b98bdde213de31dab697c01b;p=platform%2Fkernel%2Flinux-rpi.git

udf: Fix error handling in udf_new_inode()

When memory allocation of iinfo or block allocation fails, already
allocated struct udf_inode_info gets freed with iput() and
udf_evict_inode() may look at inode fields which are not properly
initialized. Fix it by marking inode bad before dropping reference to it
in udf_new_inode().

Reported-by: syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
---

diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 2ecf0e8..b5d611c 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -77,6 +77,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
 					GFP_KERNEL);
 	}
 	if (!iinfo->i_data) {
+		make_bad_inode(inode);
 		iput(inode);
 		return ERR_PTR(-ENOMEM);
 	}
@@ -86,6 +87,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
 			      dinfo->i_location.partitionReferenceNum,
 			      start, &err);
 	if (err) {
+		make_bad_inode(inode);
 		iput(inode);
 		return ERR_PTR(err);
 	}