[Devel] [PATCH RHEL7 COMMIT] ms/fix inode leaks on d_splice_alias() failure exits

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-957.21.3.vz7.106.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-957.21.3.vz7.106.3
------>
commit 4fd4fc91fa1f99bc3bdf744291582ab82f483d3c
Author: Al Viro <viro at zeniv.linux.org.uk>
Date:   Mon Jul 1 12:37:18 2019 +0300

    ms/fix inode leaks on d_splice_alias() failure exits
    
    d_splice_alias() callers expect it to either stash the inode reference
    into a new alias, or drop the inode reference.  That makes it possible
    to just return d_splice_alias() result from ->lookup() instance, without
    any extra housekeeping required.
    
    Unfortunately, that should include the failure exits.  If d_splice_alias()
    returns an error, it leaves the dentry it has been given negative and
    thus it *must* drop the inode reference.  Easily fixed, but it goes way
    back and will need backporting.
    
    Cc: stable at vger.kernel.org
    Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
    (cherry picked from commit 51486b900ee92856b977eacfc5bfbe6565028070)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 fs/dcache.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/dcache.c b/fs/dcache.c
index 50f99faad6a5..deec5cbb7b0c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2829,11 +2829,13 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
 			if (!IS_ROOT(new)) {
 				spin_unlock(&inode->i_lock);
 				dput(new);
+				iput(inode);
 				return ERR_PTR(-EIO);
 			}
 			if (d_ancestor(new, dentry)) {
 				spin_unlock(&inode->i_lock);
 				dput(new);
+				iput(inode);
 				return ERR_PTR(-EIO);
 			}
 			write_seqlock(&rename_lock);