From: Dan Carpenter <dan.carpenter@linaro.org> mainline inclusion from mainline-v6.15-rc1 commit 8e5419d6542fdf2dca9a0acdef2b8255f0e4ba69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO2H CVE: CVE-2025-39697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Call nfs_release_request() on this error path before returning. Fixes: c3f2235782c3 ("nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/3aaaa3d5-1c8a-41e4-98c7-717801ddd171@stanley.mount... Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> --- fs/nfs/write.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 95fa2f89d3a4..2350a3d81362 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -576,8 +576,10 @@ static struct nfs_page *nfs_lock_and_join_requests(struct folio *folio) while (!nfs_lock_request(head)) { ret = nfs_wait_on_request(head); - if (ret < 0) + if (ret < 0) { + nfs_release_request(head); return ERR_PTR(ret); + } } /* Ensure that nobody removed the request before we locked it */ -- 2.46.1