commit 588b2d2beb4b3d1878a7fd9cdc876bab53326476
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Jul 25 08:02:24 2026 +0200

    Linux 6.12.98
    
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 913e7b4459d6eef807bb8088b39b890ed6a74ee3
Author: Yun Zhou <yun.zhou@windriver.com>
Date:   Sat Jul 25 10:40:29 2026 +0800

    ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
    
    The backport of upstream commit c143957520c6 ("ext4: validate donor
    file superblock early in EXT4_IOC_MOVE_EXT") uses a bare 'return -EXDEV'
    which is safe upstream because the fd is managed via CLASS(fd) with
    automatic cleanup (commit 8152f8201088 ("fdget(), more trivial
    conversions")).
    
    However, on 6.12.y the ioctl still uses the traditional fdget/fdput
    pattern, so the bare return bypasses fdput(donor) at the mext_out label,
    leaking the file reference.
    
    Fix by setting err and using goto mext_out.
    
    Fixes: 74796e886ca3 ("ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT")
    Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>