[PATCH 03/16] squashfs: release the grabbed pages if allocating the page actor fails

From: Tal Zussman

Date: Tue Nov 03 2026 - 08:33:57 EST


squashfs_readpage_block() grabs and locks every page in the block before
it allocates the page actor. If that allocation fails it jumps straight
to out, which leaves all of those pages locked with an extra reference,
and anything that later reads them waits forever.

Go through mark_errored instead, which unlocks and releases them.

Fixes: f268eedddf35 ("squashfs: extend "page actor" to handle missing pages")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tal Zussman <tz2294@xxxxxxxxxxxx>
---
fs/squashfs/file_direct.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
index 2c3e809d6891..3b6aa4727c79 100644
--- a/fs/squashfs/file_direct.c
+++ b/fs/squashfs/file_direct.c
@@ -70,7 +70,7 @@ int squashfs_readpage_block(struct folio *folio, u64 block, int bsize,
actor = squashfs_page_actor_init_special(msblk, page, pages, expected,
start_index << PAGE_SHIFT);
if (actor == NULL)
- goto out;
+ goto mark_errored;

/* Decompress directly into the page cache buffers */
res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor);
@@ -118,7 +118,6 @@ int squashfs_readpage_block(struct folio *folio, u64 block, int bsize,
put_page(page[i]);
}

-out:
kfree(page);
return res;
}

--
2.39.5