This is a note to let you know that I've just added the patch titled ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ext4-fix-buffer-leak-in-ext4_expand_extra_isize_ea-on-error-path.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 53692ec074d00589c2cf1d6d17ca76ad0adce6ec Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs@xxxxxxxxxxxxx> Date: Wed, 7 Nov 2018 11:14:35 -0500 Subject: ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path From: Vasily Averin <vvs@xxxxxxxxxxxxx> commit 53692ec074d00589c2cf1d6d17ca76ad0adce6ec upstream. Fixes: de05ca852679 ("ext4: move call to ext4_error() into ...") Signed-off-by: Vasily Averin <vvs@xxxxxxxxxxxxx> Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> Cc: stable@xxxxxxxxxx # 4.17 Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/ext4/xattr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2708,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct in struct ext4_inode *raw_inode, handle_t *handle) { struct ext4_xattr_ibody_header *header; - struct buffer_head *bh; struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); static unsigned int mnt_count; size_t min_offs; @@ -2749,13 +2748,17 @@ retry: * EA block can hold new_extra_isize bytes. */ if (EXT4_I(inode)->i_file_acl) { + struct buffer_head *bh; + bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl); error = -EIO; if (!bh) goto cleanup; error = ext4_xattr_check_block(inode, bh); - if (error) + if (error) { + brelse(bh); goto cleanup; + } base = BHDR(bh); end = bh->b_data + bh->b_size; min_offs = end - base; Patches currently in stable-queue which might be from vvs@xxxxxxxxxxxxx are queue-4.19/ext4-fix-buffer-leak-in-ext4_expand_extra_isize_ea-on-error-path.patch queue-4.19/ext4-add-missing-brelse-add_new_gdb_meta_bg-s-error-path.patch queue-4.19/mm-swapfile.c-use-kvzalloc-for-swap_info_struct-allocation.patch queue-4.19/ext4-avoid-buffer-leak-in-ext4_orphan_add-after-prior-errors.patch queue-4.19/ext4-missing-bh-check-in-ext4_xattr_inode_write.patch queue-4.19/ext4-avoid-buffer-leak-on-shutdown-in-ext4_mark_iloc_dirty.patch queue-4.19/ext4-release-bs.bh-before-re-using-in-ext4_xattr_block_find.patch queue-4.19/ext4-fix-missing-cleanup-if-ext4_alloc_flex_bg_array-fails-while-resizing.patch queue-4.19/ext4-fix-buffer-leak-in-__ext4_read_dirblock-on-error-path.patch queue-4.19/ext4-fix-possible-inode-leak-in-the-retry-loop-of-ext4_resize_fs.patch queue-4.19/ext4-fix-buffer-leak-in-ext4_xattr_get_block-on-error-path.patch queue-4.19/ext4-fix-possible-leak-of-sbi-s_group_desc_leak-in-error-path.patch queue-4.19/ext4-add-missing-brelse-in-set_flexbg_block_bitmap-s-error-path.patch queue-4.19/ext4-fix-buffer-leak-in-ext4_xattr_move_to_block-on-error-path.patch queue-4.19/ext4-avoid-potential-extra-brelse-in-setup_new_flex_group_blocks.patch queue-4.19/ext4-add-missing-brelse-update_backups-s-error-path.patch queue-4.19/ext4-avoid-possible-double-brelse-in-add_new_gdb-on-error-path.patch queue-4.19/ext4-fix-possible-leak-of-s_journal_flag_rwsem-in-error-path.patch