loop: fix backing file reference leak on validation error

loop_change_fd() and loop_configure() call loop_check_backing_file()
to validate the new backing file. If validation fails, the reference
acquired by fget() was not dropped, leaking a file reference.

Fix this by calling fput(file) before returning the error.

Cc: [email protected]
Cc: Markus Elfring <[email protected]>
CC: Yang Erkun <[email protected]>
Cc: Ming Lei <[email protected]>
Cc: Yu Kuai <[email protected]>
Fixes: f5c84ef ("loop: Add sanity check for read/write_iter")
Signed-off-by: Li Chen <[email protected]>
Reviewed-by: Ming Lei <[email protected]>
Reviewed-by: Yang Erkun <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

Author: FirstLoveLife

drivers/block/loop.c

@@ -551,8 +551,10 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
 		return -EBADF;
 
 	error = loop_check_backing_file(file);
-	if (error)
+	if (error) {
+		fput(file);
 		return error;
+	}
 
 	/* suppress uevents while reconfiguring the device */
 	dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
@@ -993,8 +995,10 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
 		return -EBADF;
 
 	error = loop_check_backing_file(file);
-	if (error)
+	if (error) {
+		fput(file);
 		return error;
+	}
 
 	is_loop = is_loop_device(file);