ext4: fix inline data error paths

The write_end() function must always unlock the page and drop its ref
count, even on an error.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org

1 files changed, 8 insertions, 1 deletions

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 338cfd862adb..b777b8aa14ae 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -943,8 +943,15 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
                                   struct page *page)
 {
         int i_size_changed = 0;
+        int ret;
 
-        copied = ext4_write_inline_data_end(inode, pos, len, copied, page);
+        ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
+        if (ret < 0) {
+                unlock_page(page);
+                put_page(page);
+                return ret;
+        }
+        copied = ret;
 
         /*
          * No need to use i_size_read() here, the i_size