[PATCH 1/2] fs/qnx4: release the buffer head on an invalid extent-block signature
From: Bryam Vargas
Date: Sat Jun 06 2026 - 04:21:40 EST
In qnx4_block_map(), after sb_bread() reads an extent block, the
"IamXblk" signature-mismatch path returns -EIO without releasing the
buffer head, leaking it on every malformed extent block. Release it
before returning.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
---
fs/qnx4/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 4deb0eeadbde..3828ba7d4492 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -109,6 +109,7 @@ unsigned long qnx4_block_map( struct inode *inode, long iblock )
xblk = (struct qnx4_xblk*)bh->b_data;
if ( memcmp( xblk->xblk_signature, "IamXblk", 7 ) ) {
QNX4DEBUG((KERN_ERR "qnx4: block at %ld is not a valid xtnt\n", qnx4_inode->i_xblk));
+ brelse(bh);
return -EIO;
}
}
--
2.43.0