ext4: Fix memory and buffer head leak in callers to ext4_ext_find_extent()

The path variable returned via ext4_ext_find_extent is a kmalloc
variable and needs to be freeded.  It also contains a reference to
buffer_head which needs to be dropped.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Mingming Cao <cmm@us.ibm.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e856f660fc301dcefcead1bc995a115f8e59d6d5..995ac16102a982572c1c43e825c785429a62900e 100644 (file)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -349,7 +349,7 @@ static void ext4_ext_show_leaf(struct inode *inode, struct ext4_ext_path *path)
 #define ext4_ext_show_leaf(inode,path)
 #endif
 
-static void ext4_ext_drop_refs(struct ext4_ext_path *path)
+void ext4_ext_drop_refs(struct ext4_ext_path *path)
 {
        int depth = path->p_depth;
        int i;
@@ -2200,10 +2200,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                newdepth = ext_depth(inode);
                if (newdepth != depth) {
                        depth = newdepth;
-                       path = ext4_ext_find_extent(inode, iblock, NULL);
+                       ext4_ext_drop_refs(path);
+                       path = ext4_ext_find_extent(inode, iblock, path);
                        if (IS_ERR(path)) {
                                err = PTR_ERR(path);
-                               path = NULL;
                                goto out;
                        }
                        eh = path[depth].p_hdr;

diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 8c6c685b9d22e1d399d34066e5e6a497150c81a9..5c1e27de7755b46552c3fd85dd11ad66d0ec1490 100644 (file)
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -43,6 +43,7 @@ static int finish_range(handle_t *handle, struct inode *inode,
 
        if (IS_ERR(path)) {
                retval = PTR_ERR(path);
+               path = NULL;
                goto err_out;
        }
 
@@ -74,6 +75,10 @@ static int finish_range(handle_t *handle, struct inode *inode,
        }
        retval = ext4_ext_insert_extent(handle, inode, path, &newext);
 err_out:
+       if (path) {
+               ext4_ext_drop_refs(path);
+               kfree(path);
+       }
        lb->first_pblock = 0;
        return retval;
 }

diff --git a/include/linux/ext4_fs_extents.h b/include/linux/ext4_fs_extents.h
index 697da4bce6c513b003e9118d95e8bda34eeeb81a..1285c583b2d868421366fc71bb05cc12c507225f 100644 (file)
--- a/include/linux/ext4_fs_extents.h
+++ b/include/linux/ext4_fs_extents.h
@@ -227,5 +227,6 @@ extern int ext4_ext_search_left(struct inode *, struct ext4_ext_path *,
                                                ext4_lblk_t *, ext4_fsblk_t *);
 extern int ext4_ext_search_right(struct inode *, struct ext4_ext_path *,
                                                ext4_lblk_t *, ext4_fsblk_t *);
+extern void ext4_ext_drop_refs(struct ext4_ext_path *);
 #endif /* _LINUX_EXT4_EXTENTS */