mpage_submit_partial_folio() takes a reference with filemap_get_folio(), but returns without dropping it if the mapping position fails the WARN_ON_ONCE() check. Release the lookup reference before returning -EINVAL. Leave the folio locked for the caller's cleanup. Fixes: ded2d726a304 ("ext4: fix stale data if it bail out of the extents mapping loop") Cc: stable@vger.kernel.org Signed-off-by: Julian Sun --- fs/ext4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 81aac8744f3d..e1c69431e4dc 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2579,8 +2579,10 @@ static loff_t mpage_submit_partial_folio(struct mpage_da_data *mpd, bool fatal) */ pos = ((loff_t)mpd->map.m_lblk) << inode->i_blkbits; if (WARN_ON_ONCE((folio_pos(folio) == pos) || - !folio_contains(folio, pos >> PAGE_SHIFT))) + !folio_contains(folio, pos >> PAGE_SHIFT))) { + folio_put(folio); return -EINVAL; + } end = folio_next_pos(folio); mpage_submit_folio(mpd, folio, fatal); -- 2.39.5