summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorTheodore Ts'o <tytso@mit.edu>2017-02-04 23:04:00 -0500
committerBen Hutchings <ben@decadent.org.uk>2017-06-05 21:17:03 +0100
commitf5623c19f2928d78ad50fa13ac357106bb3d737a (patch)
tree2f5872f02b9ff26bf929f4556b08c877f919e6db /fs
parentec6d08f3a2e9f2e3a177704ae79396d19fbbf8dd (diff)
downloadlinux-stable-f5623c19f2928d78ad50fa13ac357106bb3d737a.tar.gz
linux-stable-f5623c19f2928d78ad50fa13ac357106bb3d737a.tar.bz2
linux-stable-f5623c19f2928d78ad50fa13ac357106bb3d737a.zip
ext4: fix inline data error paths
commit eb5efbcb762aee4b454b04f7115f73ccbcf8f0ef upstream. The write_end() function must always unlock the page and drop its ref count, even on an error. Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/inline.c9
-rw-r--r--fs/ext4/inode.c20
2 files changed, 23 insertions, 6 deletions
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 7ce3532c91e4..fa89f7b23ab9 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -931,8 +931,15 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
struct page *page)
{
int i_size_changed = 0;
+ int ret;
- copied = ext4_write_inline_data_end(inode, pos, len, copied, page);
+ ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
+ if (ret < 0) {
+ unlock_page(page);
+ put_page(page);
+ return ret;
+ }
+ copied = ret;
/*
* No need to use i_size_read() here, the i_size
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 142cf48faf3d..7719a2a52c97 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1118,8 +1118,11 @@ static int ext4_write_end(struct file *file,
if (ext4_has_inline_data(inode)) {
ret = ext4_write_inline_data_end(inode, pos, len,
copied, page);
- if (ret < 0)
+ if (ret < 0) {
+ unlock_page(page);
+ put_page(page);
goto errout;
+ }
copied = ret;
} else
copied = block_write_end(file, mapping, pos,
@@ -1218,10 +1221,16 @@ static int ext4_journalled_write_end(struct file *file,
BUG_ON(!ext4_handle_valid(handle));
- if (ext4_has_inline_data(inode))
- copied = ext4_write_inline_data_end(inode, pos, len,
- copied, page);
- else if (unlikely(copied < len) && !PageUptodate(page)) {
+ if (ext4_has_inline_data(inode)) {
+ ret = ext4_write_inline_data_end(inode, pos, len,
+ copied, page);
+ if (ret < 0) {
+ unlock_page(page);
+ put_page(page);
+ goto errout;
+ }
+ copied = ret;
+ } else if (unlikely(copied < len) && !PageUptodate(page)) {
copied = 0;
ext4_journalled_zero_new_buffers(handle, page, from, to);
} else {
@@ -1253,6 +1262,7 @@ static int ext4_journalled_write_end(struct file *file,
*/
ext4_orphan_add(handle, inode);
+errout:
ret2 = ext4_journal_stop(handle);
if (!ret)
ret = ret2;