]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
btrfs: fix a potential path leak in print_data_reloc_error()
authorQu Wenruo <wqu@suse.com>
Tue, 25 Nov 2025 08:19:56 +0000 (18:49 +1030)
committerDavid Sterba <dsterba@suse.com>
Tue, 9 Dec 2025 03:35:28 +0000 (04:35 +0100)
Inside print_data_reloc_error(), if extent_from_logical() failed we
return immediately.

However there are the following cases where extent_from_logical() can
return error but still holds a path:

- btrfs_search_slot() returned 0

- No backref item found in extent tree

- No flags_ret provided
  This is not possible in this call site though.

So for the above two cases, we can return without releasing the path,
causing extent buffer leaks.

Fixes: b9a9a85059cd ("btrfs: output affected files when relocation fails")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
fs/btrfs/inode.c

index 0cbac085cdafc2dd49383418a618b73ad34d3c8a..6633b3dc931409c3bc3355768319e83ef92497d9 100644 (file)
@@ -255,6 +255,7 @@ static void print_data_reloc_error(const struct btrfs_inode *inode, u64 file_off
        if (ret < 0) {
                btrfs_err_rl(fs_info, "failed to lookup extent item for logical %llu: %d",
                             logical, ret);
+               btrfs_release_path(&path);
                return;
        }
        eb = path.nodes[0];