From: Filipe Manana Date: Thu, 13 Nov 2025 12:52:45 +0000 (+0000) Subject: btrfs: fix leaf leak in an error path in btrfs_del_items() X-Git-Tag: v6.19-rc1~167^2~40 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e7dd1182fcedee7c6097c9f49eba8de94a4364e3;p=thirdparty%2Fkernel%2Flinux.git btrfs: fix leaf leak in an error path in btrfs_del_items() If the call to btrfs_del_leaf() fails we return without decrementing the extra ref we took on the leaf, therefore leaking it. Fix this by ensuring we drop the ref count before returning the error. Fixes: 751a27615dda ("btrfs: do not BUG_ON() on tree mod log failures at btrfs_del_ptr()") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba --- diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index f6a9b6bbf78bd..614aa4b56571b 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -4562,9 +4562,9 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root, if (btrfs_header_nritems(leaf) == 0) { path->slots[1] = slot; ret = btrfs_del_leaf(trans, root, path, leaf); + free_extent_buffer(leaf); if (ret < 0) return ret; - free_extent_buffer(leaf); ret = 0; } else { /* if we're still in the path, make sure