diff options
author | Theodore Ts'o <tytso@mit.edu> | 2017-02-04 23:04:00 -0500 |
---|---|---|
committer | Theodore Ts'o <tytso@mit.edu> | 2017-02-04 23:04:00 -0500 |
commit | eb5efbcb762aee4b454b04f7115f73ccbcf8f0ef (patch) | |
tree | d8502cb44de45fe27a69b4b352bd763f2b1a1752 /fs/ext4/inode.c | |
parent | 1c83a9aab807f7452c4957b2401e1cbf43941820 (diff) | |
download | op-kernel-dev-eb5efbcb762aee4b454b04f7115f73ccbcf8f0ef.zip op-kernel-dev-eb5efbcb762aee4b454b04f7115f73ccbcf8f0ef.tar.gz |
ext4: fix inline data error paths
The write_end() function must always unlock the page and drop its ref
count, even on an error.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/ext4/inode.c')
-rw-r--r-- | fs/ext4/inode.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 918d351..af97b91 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1330,8 +1330,11 @@ static int ext4_write_end(struct file *file, if (ext4_has_inline_data(inode)) { ret = ext4_write_inline_data_end(inode, pos, len, copied, page); - if (ret < 0) + if (ret < 0) { + unlock_page(page); + put_page(page); goto errout; + } copied = ret; } else copied = block_write_end(file, mapping, pos, @@ -1433,10 +1436,16 @@ static int ext4_journalled_write_end(struct file *file, BUG_ON(!ext4_handle_valid(handle)); - if (ext4_has_inline_data(inode)) - copied = ext4_write_inline_data_end(inode, pos, len, - copied, page); - else if (unlikely(copied < len) && !PageUptodate(page)) { + if (ext4_has_inline_data(inode)) { + ret = ext4_write_inline_data_end(inode, pos, len, + copied, page); + if (ret < 0) { + unlock_page(page); + put_page(page); + goto errout; + } + copied = ret; + } else if (unlikely(copied < len) && !PageUptodate(page)) { copied = 0; ext4_journalled_zero_new_buffers(handle, page, from, to); } else { @@ -1471,6 +1480,7 @@ static int ext4_journalled_write_end(struct file *file, */ ext4_orphan_add(handle, inode); +errout: ret2 = ext4_journal_stop(handle); if (!ret) ret = ret2; |