[PATCH] ext3_orphan_del may double-decrement bh->b_count

From: Jeff Mahoney <jeffm@suse.com>

Chris Mason and I ran across this one while hunting down another bug.

If ext3_mark_iloc_dirty() fails in ext3_orphan_del() on the outer buffer,
bh->b_count will be decremented twice.  ext3_mark_iloc_dirty() will brelse
the buffer, even on error.  ext3_orphan_del() is explicity brelse'ing the
buffer on error.  Prior to calling ext3_mark_iloc_dirty(), this is the
correct behavior.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

fs/ext3/namei.c

@@ -1962,8 +1962,6 @@ int ext3_orphan_del(handle_t *handle, struct inode *inode)
 		goto out_brelse;
 	NEXT_ORPHAN(inode) = 0;
 	err = ext3_mark_iloc_dirty(handle, inode, &iloc);
-	if (err)
-		goto out_brelse;
 
 out_err:
 	ext3_std_error(inode->i_sb, err);