fs/dirty_pages: fix wrong 'buff_num' after invalid input

euler inclusion
category: bugfix
bugzilla: 46858
CVE: NA

---------------------------

In 'write_proc', if input from userspace is invlid, the 'buff_num'
will be set to 0 with unfreed buffer.

Fix it by setting 'buff_num' to 'old_buff_num'.
Reported-by: Nsong jian <songjian15@huawei.com>
Signed-off-by: Nyu kuai <yukuai3@huawei.com>
Reviewed-by: Nzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: Nzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: NDianfang Zhang <zhangdianfang@huawei.com>
Acked-by: NXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: NChen Jun <chenjun102@huawei.com>

fs/dirty_pages.c

@@ -259,7 +259,7 @@ static ssize_t write_proc(
 	old_buff_num = buff_num;
 	ret = kstrtol(msg, 10, &buff_num);
 	if (ret != 0 || buff_num < 0 || buff_num > MAX_BUFF_SIZE) {
-		buff_num = 0;
+		buff_num = old_buff_num;
 		ret = -EINVAL;
 		goto free;
 	}