Plug buffer head leak on submit for the 7.2 kernel

Starting with the 7.2 kernel, buffer heads no longer lose a reference
during the submit-wait procedure. I didn't notice that change, so now I
would expect all buffer heads to be leaking. The fact that I still can't
tell the difference makes me believe, like I mentioned before, that
somehow the kernel is still disposing of the buffer heads. Either way,
fix this.

Signed-off-by: Ernesto A. Fernández <ernesto@corellium.com>

README.rst

@@ -57,10 +57,15 @@ Now you can just cd to the linux-apfs-rw directory and run::
 	make
 
 The resulting module is the apfs.ko file. Before you can use it you must insert
-it into the kernel, as well as its dependencies. Again as root::
+it into the kernel. Again as root::
+
+	insmod apfs.ko
+
+If you get an "unknown symbol in module" error, run::
 
 	modprobe libcrc32c
-	insmod apfs.ko
+
+and then try the insmod command again.
 
 Mount
 =====

apfs.h

@@ -44,10 +44,33 @@ static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags
 #endif
 
 /* Compatibility wrapper around submit_bh() */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0) || RHEL_VERSION_GE(9, 2)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 2, 0)
-#define apfs_submit_bh(op, op_flags, bh) submit_bh(op | op_flags, bh)
+#define apfs_submit_bh(op, op_flags, bh)				\
+do {									\
+	put_bh(bh);							\
+	if (op == REQ_OP_READ)						\
+		bh_submit(bh, op | op_flags, bh_end_read);		\
+	else								\
+		bh_submit(bh, op | op_flags, bh_end_write);		\
+} while (0)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0) || RHEL_VERSION_GE(9, 2)
+#define apfs_submit_bh(op, op_flags, bh)				\
+do {									\
+	if (op == REQ_OP_READ)						\
+		bh->b_end_io = end_buffer_read_sync;			\
+	else								\
+		bh->b_end_io = end_buffer_write_sync;			\
+	submit_bh(op | op_flags, bh);					\
+} while (0)
 #else
-#define apfs_submit_bh(op, op_flags, bh) submit_bh(op, op_flags, bh)
+#define apfs_submit_bh(op, op_flags, bh)				\
+do {									\
+	if (op == REQ_OP_READ)						\
+		bh->b_end_io = end_buffer_read_sync;			\
+	else								\
+		bh->b_end_io = end_buffer_write_sync;			\
+	submit_bh(op, op_flags, bh);					\
+} while (0)
 #endif
 
 /*
@@ -1324,7 +1347,7 @@ __apfs_getblk(struct super_block *sb, sector_t block)
 		block -= nxi->nx_tier2_bno;
 	}
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 7, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 7, 0) && !RHEL_VERSION_GE(9, 8)
 	return __getblk_gfp(info->blki_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
 #else
 	return bdev_getblk(info->blki_bdev, block, sb->s_blocksize, __GFP_MOVABLE);

dkms.conf

@@ -1,5 +1,5 @@
 PACKAGE_NAME="linux-apfs-rw"
-PACKAGE_VERSION="0.3.20"
+PACKAGE_VERSION="0.3.21"
 
 BUILT_MODULE_NAME[0]="apfs"
 DEST_MODULE_LOCATION[0]="/extra"

extents.c

@@ -2298,7 +2298,6 @@ int apfs_nonsparse_dstream_read(struct apfs_dstream_info *dstream, void *buf, si
 		if (!buffer_uptodate(bh)) {
 			get_bh(bh);
 			lock_buffer(bh);
-			bh->b_end_io = end_buffer_read_sync;
 			apfs_submit_bh(REQ_OP_READ, 0, bh);
 		}
 	}
@@ -2365,7 +2364,6 @@ void apfs_nonsparse_dstream_preread(struct apfs_dstream_info *dstream)
 		if (!buffer_uptodate(bh)) {
 			get_bh(bh);
 			lock_buffer(bh);
-			bh->b_end_io = end_buffer_read_sync;
 			apfs_submit_bh(REQ_OP_READ, 0, bh);
 		}
 		brelse(bh);

inode.c

@@ -556,7 +556,6 @@ int __apfs_write_begin(struct file *file, struct address_space *mapping, loff_t
 			if (buffer_mapped(bh) && !buffer_uptodate(bh)) {
 				get_bh(bh);
 				lock_buffer(bh);
-				bh->b_end_io = end_buffer_read_sync;
 				apfs_submit_bh(REQ_OP_READ, 0, bh);
 				wait_on_buffer(bh);
 				if (!buffer_uptodate(bh)) {

lzfse/lzfse_internal.h

@@ -70,7 +70,9 @@ typedef int64_t lzfse_offset;
 typedef int32_t lzfse_offset;
 #endif
 
+#if !defined(__APPLE__) || !defined(__MACH__)
 typedef uint64_t uintmax_t;
+#endif
 
 /*! @abstract Decoder state object for lzfse compressed blocks. */
 typedef struct {

spaceman.c

@@ -308,6 +308,7 @@ static int apfs_write_single_ip_bitmap(struct super_block *sb, char *bitmap, u32
 	err = apfs_transaction_join(sb, bh);
 	if (err)
 		goto fail;
+	put_bh(bh);
 	bh = NULL;
 
 	spaceman->sm_ip_bmaps[idx].dirty = false;

super.c

@@ -343,8 +343,8 @@ static int apfs_read_main_super(struct super_block *sb)
 	xid = le64_to_cpu(msb_raw->nx_o.o_xid);
 	for (i = 0; i < desc_blocks; ++i) {
 		struct apfs_nx_superblock *desc_raw;
+		bool ignore;
 
-		brelse(desc_bh);
 		desc_bh = apfs_sb_bread(sb, desc_base + i);
 		if (!desc_bh) {
 			apfs_err(sb, "unable to read checkpoint descriptor");
@@ -352,18 +352,24 @@ static int apfs_read_main_super(struct super_block *sb)
 		}
 		desc_raw = (struct apfs_nx_superblock *)desc_bh->b_data;
 
+		ignore = false;
 		if (le32_to_cpu(desc_raw->nx_magic) != APFS_NX_MAGIC)
-			continue; /* Not a superblock */
+			ignore = true; /* Not a superblock */
 		if (le64_to_cpu(desc_raw->nx_o.o_xid) <= xid)
-			continue; /* Old */
+			ignore = true; /* Old */
 		if (!apfs_obj_verify_csum(sb, desc_bh))
-			continue; /* Corrupted */
+			ignore = true; /* Corrupted */
 
-		xid = le64_to_cpu(desc_raw->nx_o.o_xid);
+		if (ignore) {
-		msb_raw = desc_raw;
+			brelse(desc_bh);
-		bno = desc_base + i;
+		} else {
-		brelse(bh);
+			xid = le64_to_cpu(desc_raw->nx_o.o_xid);
-		bh = desc_bh;
+			msb_raw = desc_raw;
+			bno = desc_base + i;
+			brelse(bh);
+			bh = desc_bh;
+		}
+		desc_raw = NULL;
 		desc_bh = NULL;
 	}
 

transaction.c

@@ -640,6 +640,9 @@ static int apfs_write_ephemeral_objects(struct super_block *sb)
 		}
 		data_len += obj_blkcnt;
 	}
+	brelse(cpm_bh);
+	cpm = NULL;
+	cpm_bh = NULL;
 
 	/*
 	 * The checkpoint superblock can't be set until the very end of the
@@ -721,7 +724,6 @@ static int apfs_transaction_commit_nx(struct super_block *sb)
 		clear_buffer_dirty(bh);
 		get_bh(bh);
 		lock_buffer(bh);
-		bh->b_end_io = end_buffer_write_sync;
 		apfs_submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
 	}
 	list_for_each_entry_safe(bhi, tmp, &nx_trans->t_buffers, list) {