Re: [PATCH] ext4: fix folio reference leak in mpage_submit_partial_folio()

[Zhang Yi <yizhang089@gmail.com>]

On 10/16/2026 10:25 PM, guolingxing wrote:
> mpage_submit_partial_folio() obtains a folio reference with
> filemap_get_folio(). If the subsequent position check fails, it
> returns -EINVAL without dropping that reference.
> 
> Call folio_put() before returning from this error path. Leave the
> folio locked so that the caller can invalidate and unlock it through
> mpage_release_unused_pages().
> 
> Fixes: ded2d726a304 ("ext4: fix stale data if it bail out of the extents mapping loop")
> Cc: stable@vger.kernel.org
> Signed-off-by: guolingxing <guolingxing@tju.edu.cn>

Thank you for the fix, looks good to me.

Reviewed-by: Zhang Yi <yi.zhang@huawei.com>

> ---
>   fs/ext4/inode.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 26f0f9714f03..7afba6298fa2 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -2412,8 +2412,14 @@ static int mpage_submit_partial_folio(struct mpage_da_data *mpd)
>   	 */
>   	pos = ((loff_t)mpd->map.m_lblk) << inode->i_blkbits;
>   	if (WARN_ON_ONCE((folio_pos(folio) == pos) ||
> -			 !folio_contains(folio, pos >> PAGE_SHIFT)))
> +			 !folio_contains(folio, pos >> PAGE_SHIFT))) {
> +		/*
> +		 * Leave the folio locked so that the caller can invalidate
> +		 * and unlock it through mpage_release_unused_pages().
> +		 */
> +		folio_put(folio);
>   		return -EINVAL;
> +	}
>   
>   	mpage_submit_folio(mpd, folio);
>   	/*