Forked from
drm / msm
-
Jan Kara authored
When memory allocation of iinfo or block allocation fails, already allocated struct udf_inode_info gets freed with iput() and udf_evict_inode() may look at inode fields which are not properly initialized. Fix it by marking inode bad before dropping reference to it in udf_new_inode(). Reported-by:
<syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com> Signed-off-by:
Jan Kara <jack@suse.cz>
Jan Kara authoredWhen memory allocation of iinfo or block allocation fails, already allocated struct udf_inode_info gets freed with iput() and udf_evict_inode() may look at inode fields which are not properly initialized. Fix it by marking inode bad before dropping reference to it in udf_new_inode(). Reported-by:
<syzbot+9ca499bb57a2b9e4c652@syzkaller.appspotmail.com> Signed-off-by:
Jan Kara <jack@suse.cz>