[PATCH v5 2/6] qnx6: release bh on error path in qnx6_block_map()

[Hui Peng]

In qnx6_block_map(), when sb_bread() fails during indirect block tree
traversal, the function returns 0 without calling brelse(bh), leaking the
previously fetched buffer head bh.

Call brelse(bh) before returning 0 on error paths in qnx6_block_map().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Matthias Goergens <matthias.goergens@xxxxxxxxx>
Tested-by: Matthias Goergens <matthias.goergens@xxxxxxxxx>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
 fs/qnx6/inode.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c
index eb6b5dfbc599..3c880854c867 100644
--- a/fs/qnx6/inode.c
+++ b/fs/qnx6/inode.c
@@ -242,8 +242,10 @@ unsigned long qnx6_block_map(struct inode *inode, unsigned int iblock)
 
 		block = fs32_to_cpu(sbi, *ptr);
 		bh = sb_bread(inode->i_sb, block);
-		if (!bh)
+		if (!bh) {
+			brelse(bh);
 			return 0;
+		}
 	}
 
 	idx = (iblock >> (level * sbi->s_ptrbits)) & (sbi->s_ptrbits - 1);
-- 
2.47.3