jffs2: Fix in-core inode leaks on error paths

Pointed out by Al Viro.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 7aa4417..cb7ef34 100644 (file)
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -360,8 +360,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                /* Eeek. Wave bye bye */
                mutex_unlock(&f->sem);
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fn);
+               ret = PTR_ERR(fn);
+               goto fail;
        }
 
        /* We use f->target field to store the target path. */
@@ -370,8 +370,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
                mutex_unlock(&f->sem);
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto fail;
        }
 
        memcpy(f->target, target, targetlen + 1);
@@ -386,30 +386,24 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
        jffs2_complete_reservation(c);
 
        ret = jffs2_init_security(inode, dir_i);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
+
        ret = jffs2_init_acl_post(inode);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-       if (ret) {
-               /* Eep. */
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        rd = jffs2_alloc_raw_dirent();
        if (!rd) {
                /* Argh. Now we treat it like a normal delete */
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto fail;
        }
 
        dir_f = JFFS2_INODE_INFO(dir_i);
@@ -437,8 +431,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                jffs2_complete_reservation(c);
                jffs2_free_raw_dirent(rd);
                mutex_unlock(&dir_f->sem);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fd);
+               ret = PTR_ERR(fd);
+               goto fail;
        }
 
        dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -454,6 +448,11 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
 
        d_instantiate(dentry, inode);
        return 0;
+
+ fail:
+       make_bad_inode(inode);
+       iput(inode);
+       return ret;
 }
 
 
@@ -519,8 +518,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                /* Eeek. Wave bye bye */
                mutex_unlock(&f->sem);
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fn);
+               ret = PTR_ERR(fn);
+               goto fail;
        }
        /* No data here. Only a metadata node, which will be
           obsoleted by the first data write
@@ -531,30 +530,24 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
        jffs2_complete_reservation(c);
 
        ret = jffs2_init_security(inode, dir_i);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
+
        ret = jffs2_init_acl_post(inode);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-       if (ret) {
-               /* Eep. */
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        rd = jffs2_alloc_raw_dirent();
        if (!rd) {
                /* Argh. Now we treat it like a normal delete */
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto fail;
        }
 
        dir_f = JFFS2_INODE_INFO(dir_i);
@@ -582,8 +575,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                jffs2_complete_reservation(c);
                jffs2_free_raw_dirent(rd);
                mutex_unlock(&dir_f->sem);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fd);
+               ret = PTR_ERR(fd);
+               goto fail;
        }
 
        dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -600,6 +593,11 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
 
        d_instantiate(dentry, inode);
        return 0;
+
+ fail:
+       make_bad_inode(inode);
+       iput(inode);
+       return ret;
 }
 
 static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
@@ -693,8 +691,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                /* Eeek. Wave bye bye */
                mutex_unlock(&f->sem);
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fn);
+               ret = PTR_ERR(fn);
+               goto fail;
        }
        /* No data here. Only a metadata node, which will be
           obsoleted by the first data write
@@ -705,30 +703,24 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
        jffs2_complete_reservation(c);
 
        ret = jffs2_init_security(inode, dir_i);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
+
        ret = jffs2_init_acl_post(inode);
-       if (ret) {
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-       if (ret) {
-               /* Eep. */
-               jffs2_clear_inode(inode);
-               return ret;
-       }
+       if (ret)
+               goto fail;
 
        rd = jffs2_alloc_raw_dirent();
        if (!rd) {
                /* Argh. Now we treat it like a normal delete */
                jffs2_complete_reservation(c);
-               jffs2_clear_inode(inode);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto fail;
        }
 
        dir_f = JFFS2_INODE_INFO(dir_i);
@@ -759,8 +751,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                jffs2_complete_reservation(c);
                jffs2_free_raw_dirent(rd);
                mutex_unlock(&dir_f->sem);
-               jffs2_clear_inode(inode);
-               return PTR_ERR(fd);
+               ret = PTR_ERR(fd);
+               goto fail;
        }
 
        dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -777,6 +769,11 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
        d_instantiate(dentry, inode);
 
        return 0;
+
+ fail:
+       make_bad_inode(inode);
+       iput(inode);
+       return ret;
 }
 
 static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry,