[PATCH] ext4: fix folio reference leak in mpage_submit_partial_folio()

[PATCH] ext4: fix folio reference leak in mpage_submit_partial_folio()

[guolingxing]

mpage_submit_partial_folio() obtains a folio reference with
filemap_get_folio(). If the subsequent position check fails, it
returns -EINVAL without dropping that reference.

Call folio_put() before returning from this error path. Leave the
folio locked so that the caller can invalidate and unlock it through
mpage_release_unused_pages().

Fixes: ded2d726a304 ("ext4: fix stale data if it bail out of the extents mapping loop")
Cc: stable@vger.kernel.org
Signed-off-by: guolingxing <guolingxing@tju.edu.cn>
---
 fs/ext4/inode.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 26f0f9714f03..7afba6298fa2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2412,8 +2412,14 @@ static int mpage_submit_partial_folio(struct mpage_da_data *mpd)
 	 */
 	pos = ((loff_t)mpd->map.m_lblk) << inode->i_blkbits;
 	if (WARN_ON_ONCE((folio_pos(folio) == pos) ||
-			 !folio_contains(folio, pos >> PAGE_SHIFT)))
+			 !folio_contains(folio, pos >> PAGE_SHIFT))) {
+		/*
+		 * Leave the folio locked so that the caller can invalidate
+		 * and unlock it through mpage_release_unused_pages().
+		 */
+		folio_put(folio);
 		return -EINVAL;
+	}
 
 	mpage_submit_folio(mpd, folio);
 	/*
-- 
2.34.1

Re: [PATCH] ext4: fix folio reference leak in mpage_submit_partial_folio()

[sashiko-bot]

> mpage_submit_partial_folio() obtains a folio reference with
> filemap_get_folio(). If the subsequent position check fails, it
> returns -EINVAL without dropping that reference.
> 
> Call folio_put() before returning from this error path. Leave the
> folio locked so that the caller can invalidate and unlock it through
> mpage_release_unused_pages().
> 
> Fixes: ded2d726a304 ("ext4: fix stale data if it bail out of the extents mapping loop")
> Cc: stable@vger.kernel.org
> Signed-off-by: guolingxing <guolingxing@tju.edu.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016142524.655789-1-guolingxing@tju.edu.cn?part=1

Re: [PATCH] ext4: fix folio reference leak in mpage_submit_partial_folio()

[Zhang Yi]

On 10/16/2026 10:25 PM, guolingxing wrote:
> mpage_submit_partial_folio() obtains a folio reference with
> filemap_get_folio(). If the subsequent position check fails, it
> returns -EINVAL without dropping that reference.
> 
> Call folio_put() before returning from this error path. Leave the
> folio locked so that the caller can invalidate and unlock it through
> mpage_release_unused_pages().
> 
> Fixes: ded2d726a304 ("ext4: fix stale data if it bail out of the extents mapping loop")
> Cc: stable@vger.kernel.org
> Signed-off-by: guolingxing <guolingxing@tju.edu.cn>

Thank you for the fix, looks good to me.

Reviewed-by: Zhang Yi <yi.zhang@huawei.com>

> ---
>   fs/ext4/inode.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 26f0f9714f03..7afba6298fa2 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -2412,8 +2412,14 @@ static int mpage_submit_partial_folio(struct mpage_da_data *mpd)
>   	 */
>   	pos = ((loff_t)mpd->map.m_lblk) << inode->i_blkbits;
>   	if (WARN_ON_ONCE((folio_pos(folio) == pos) ||
> -			 !folio_contains(folio, pos >> PAGE_SHIFT)))
> +			 !folio_contains(folio, pos >> PAGE_SHIFT))) {
> +		/*
> +		 * Leave the folio locked so that the caller can invalidate
> +		 * and unlock it through mpage_release_unused_pages().
> +		 */
> +		folio_put(folio);
>   		return -EINVAL;
> +	}
>   
>   	mpage_submit_folio(mpd, folio);
>   	/*