In two error cases affs_remove_link doesn't call affs_unlock_dir to
release the i_hash_lock semaphore.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
                affs_lock_dir(dir);
                affs_fix_dcache(dentry, link_ino);
                retval = affs_remove_hash(dir, link_bh);
-               if (retval)
+               if (retval) {
+                       affs_unlock_dir(dir);
                        goto done;
+               }
                mark_buffer_dirty_inode(link_bh, inode);
 
                memcpy(AFFS_TAIL(sb, bh)->name, AFFS_TAIL(sb, link_bh)->name, 32);
                retval = affs_insert_hash(dir, bh);
-               if (retval)
+               if (retval) {
+                       affs_unlock_dir(dir);
                        goto done;
+               }
                mark_buffer_dirty_inode(bh, inode);
 
                affs_unlock_dir(dir);