After the extent tree is transferred to the original inode, ext4_journal_ensure_credits() can fail before tmp_inode is cleared. The subsequent iput(tmp_inode) may then free the transferred tree. Clear tmp_inode's size and block count as soon as ownership is transferred. Fixes: a413036791d0 ("ext4: Provide function to handle transaction restarts") Signed-off-by: Yichong Chen --- fs/ext4/migrate.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c index e588b4157604..11b3da396966 100644 --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -570,6 +570,12 @@ int ext4_ext_migrate(struct inode *inode) free_ext_block(handle, tmp_inode); } + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { + i_size_write(tmp_inode, 0); + tmp_inode->i_blocks = 0; + EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; + } + /* We mark the tmp_inode dirty via ext4_ext_tree_init. */ err = ext4_journal_ensure_credits(handle, 1, 0); if (err < 0) { -- 2.51.0