]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commitdiff
ext4: fix miss release buffer head in ext4_fc_write_inode
authorYe Bin <yebin10@huawei.com>
Wed, 14 Sep 2022 10:08:59 +0000 (18:08 +0800)
committerStefan Bader <stefan.bader@canonical.com>
Thu, 24 Nov 2022 13:24:05 +0000 (14:24 +0100)
BugLink: https://bugs.launchpad.net/bugs/1996825
commit ccbf8eeb39f2ff00b54726a2b20b35d788c4ecb5 upstream.

In 'ext4_fc_write_inode' function first call 'ext4_get_inode_loc' get 'iloc',
after use it miss release 'iloc.bh'.
So just release 'iloc.bh' before 'ext4_fc_write_inode' return.

Cc: stable@kernel.org
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220914100859.1415196-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
fs/ext4/fast_commit.c

index 285c91b0166c0f48d00e381d3c31b8362ed5feaa..eba0e766177a02d8b3b92a3f4354cc2ede45cf35 100644 (file)
@@ -794,22 +794,25 @@ static int ext4_fc_write_inode(struct inode *inode, u32 *crc)
        tl.fc_tag = cpu_to_le16(EXT4_FC_TAG_INODE);
        tl.fc_len = cpu_to_le16(inode_len + sizeof(fc_inode.fc_ino));
 
+       ret = -ECANCELED;
        dst = ext4_fc_reserve_space(inode->i_sb,
                        sizeof(tl) + inode_len + sizeof(fc_inode.fc_ino), crc);
        if (!dst)
-               return -ECANCELED;
+               goto err;
 
        if (!ext4_fc_memcpy(inode->i_sb, dst, &tl, sizeof(tl), crc))
-               return -ECANCELED;
+               goto err;
        dst += sizeof(tl);
        if (!ext4_fc_memcpy(inode->i_sb, dst, &fc_inode, sizeof(fc_inode), crc))
-               return -ECANCELED;
+               goto err;
        dst += sizeof(fc_inode);
        if (!ext4_fc_memcpy(inode->i_sb, dst, (u8 *)ext4_raw_inode(&iloc),
                                        inode_len, crc))
-               return -ECANCELED;
-
-       return 0;
+               goto err;
+       ret = 0;
+err:
+       brelse(iloc.bh);
+       return ret;
 }
 
 /*