[PATCH] ext4: drop tmp inode ownership before migration cleanup

[Yichong Chen]

After the extent tree is transferred to the original inode,
ext4_journal_ensure_credits() can fail before tmp_inode is cleared.  The
subsequent iput(tmp_inode) may then free the transferred tree.

Clear tmp_inode's size and block count as soon as ownership is transferred.

Fixes: a413036791d0 ("ext4: Provide function to handle transaction restarts")
Signed-off-by: Yichong Chen <chenyichong@xxxxxxxxxxxxx>
---
 fs/ext4/migrate.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index e588b4157604..11b3da396966 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -570,6 +570,12 @@ int ext4_ext_migrate(struct inode *inode)
 			free_ext_block(handle, tmp_inode);
 	}
 
+	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+		i_size_write(tmp_inode, 0);
+		tmp_inode->i_blocks = 0;
+		EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed;
+	}
+
 	/* We mark the tmp_inode dirty via ext4_ext_tree_init. */
 	err = ext4_journal_ensure_credits(handle, 1, 0);
 	if (err < 0) {
-- 
2.51.0