xfs: add missing bmap cancel calls in error paths

Source kernel commit d4a97a04227d5ba91b91888a016e2300861cfbc7

If a failure occurs after the bmap free list is populated and before
xfs_bmap_finish() completes successfully (which returns a partial
list on failure), the bmap free list must be cancelled. Otherwise,
the extent items on the list are never freed and a memory leak
occurs.

Several random error paths throughout the code suffer this problem.
Fix these up such that xfs_bmap_cancel() is always called on error.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

diff --git a/libxfs/xfs_bmap.c b/libxfs/xfs_bmap.c
index aef7cf320da278fd5e79ecdc848863afec7ca05d..b9e58e271e9d35b6ee7ec24f615086abb0f15959 100644 (file)
--- a/libxfs/xfs_bmap.c
+++ b/libxfs/xfs_bmap.c
@@ -5938,6 +5938,7 @@ xfs_bmap_split_extent(
        return xfs_trans_commit(tp);
 
 out:
+       xfs_bmap_cancel(&free_list);
        xfs_trans_cancel(tp);
        return error;
 }