Commit 43ae9e3f authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Al Viro
Browse files

ext[34]: fix double put in tmpfile 



d_tmpfile() already swallowed the inode ref.

Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 7dee8dff

fs/ext3/namei.c

+2 −3
Original line number Diff line number Diff line
@@ -1783,7 +1783,7 @@ static int ext3_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) 
		d_tmpfile(dentry, inode);

		err = ext3_orphan_add(handle, inode);

		if (err)

			goto err_drop_inode;

			goto err_unlock_inode;

		mark_inode_dirty(inode);

		unlock_new_inode(inode);

	}
@@ -1791,10 +1791,9 @@ static int ext3_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) 
	if (err == -ENOSPC && ext3_should_retry_alloc(dir->i_sb, &retries))

		goto retry;

	return err;

err_drop_inode:

err_unlock_inode:

	ext3_journal_stop(handle);

	unlock_new_inode(inode);

	iput(inode);

	return err;

}

fs/ext4/namei.c

+2 −3
Original line number Diff line number Diff line
@@ -2319,7 +2319,7 @@ static int ext4_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) 
		d_tmpfile(dentry, inode);

		err = ext4_orphan_add(handle, inode);

		if (err)

			goto err_drop_inode;

			goto err_unlock_inode;

		mark_inode_dirty(inode);

		unlock_new_inode(inode);

	}
@@ -2328,10 +2328,9 @@ static int ext4_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) 
	if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))

		goto retry;

	return err;

err_drop_inode:

err_unlock_inode:

	ext4_journal_stop(handle);

	unlock_new_inode(inode);

	iput(inode);

	return err;

}