[PATCH] btrfs: fix chunk map leaks in btrfs_map_block()

[PATCH] btrfs: fix chunk map leaks in btrfs_map_block()

[Mark Harmstone]

Fix the two early returns in btrfs_map_block() so that we can no longer
fail to put the chunk map after getting it.

Signed-off-by: Mark Harmstone <mark@harmstone.com>
Reported-by: Chris Mason <clm@fb.com>
---
 fs/btrfs/volumes.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 83e2834ea273..a1f0fccd552c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7082,7 +7082,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
 
 		ret = btrfs_translate_remap(fs_info, &new_logical, length);
 		if (ret)
-			return ret;
+			goto out;
 
 		if (new_logical != logical) {
 			btrfs_free_chunk_map(map);
@@ -7096,8 +7096,10 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
 	}
 
 	num_copies = btrfs_chunk_map_num_copies(map);
-	if (io_geom.mirror_num > num_copies)
-		return -EINVAL;
+	if (io_geom.mirror_num > num_copies) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	map_offset = logical - map->start;
 	io_geom.raid56_full_stripe_start = (u64)-1;
-- 
2.52.0

Re: [PATCH] btrfs: fix chunk map leaks in btrfs_map_block()

[Filipe Manana]

On Wed, Feb 18, 2026 at 2:33 PM Mark Harmstone <mark@harmstone.com> wrote:
>
> Fix the two early returns in btrfs_map_block() so that we can no longer
> fail to put the chunk map after getting it.
>
> Signed-off-by: Mark Harmstone <mark@harmstone.com>
> Reported-by: Chris Mason <clm@fb.com>

So being a bug fix, this is the type of patch that should have a Fixes tag.

The commit that introduced the first leak is not in any released
kernel, so no stable releases are affected.
However it's still useful to have the Fixes tag here, because in case
someone decides to backport the offending commit, either upstream or
downstream, there are scripts in place to check if there are newer
commits that fix a bug in the former commit and therefore must be
backported as well.

But the second leak was introduced in a much older commit, from 2024,
and should be backported.
Se comments inline below.

Also, since this was reported publicly, please add a Link tag pointing
to the URL with the review.

> ---
>  fs/btrfs/volumes.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 83e2834ea273..a1f0fccd552c 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -7082,7 +7082,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
>
>                 ret = btrfs_translate_remap(fs_info, &new_logical, length);
>                 if (ret)
> -                       return ret;
> +                       goto out;

For this hunk:

Fixes: 18ba64992871 ("btrfs: redirect I/O for remapped block groups")

>
>                 if (new_logical != logical) {
>                         btrfs_free_chunk_map(map);
> @@ -7096,8 +7096,10 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
>         }
>
>         num_copies = btrfs_chunk_map_num_copies(map);
> -       if (io_geom.mirror_num > num_copies)
> -               return -EINVAL;
> +       if (io_geom.mirror_num > num_copies) {
> +               ret = -EINVAL;
> +               goto out;
> +       }

For this hunk:

Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()")

I would suggest splitting this into 2 different patches, each one with
the respective Fixes tag so that the second leak can be backported
more easily.

>
>         map_offset = logical - map->start;
>         io_geom.raid56_full_stripe_start = (u64)-1;
> --
> 2.52.0
>
>

Re: [PATCH] btrfs: fix chunk map leaks in btrfs_map_block()

[Mark Harmstone]

On 18/02/2026 2.54 pm, Filipe Manana wrote:
> On Wed, Feb 18, 2026 at 2:33 PM Mark Harmstone <mark@harmstone.com> wrote:
>>
>> Fix the two early returns in btrfs_map_block() so that we can no longer
>> fail to put the chunk map after getting it.
>>
>> Signed-off-by: Mark Harmstone <mark@harmstone.com>
>> Reported-by: Chris Mason <clm@fb.com>
> 
> So being a bug fix, this is the type of patch that should have a Fixes tag.
> 
> The commit that introduced the first leak is not in any released
> kernel, so no stable releases are affected.
> However it's still useful to have the Fixes tag here, because in case
> someone decides to backport the offending commit, either upstream or
> downstream, there are scripts in place to check if there are newer
> commits that fix a bug in the former commit and therefore must be
> backported as well.
> 
> But the second leak was introduced in a much older commit, from 2024,
> and should be backported.
> Se comments inline below.
> 
> Also, since this was reported publicly, please add a Link tag pointing
> to the URL with the review.
> 
>> ---
>>   fs/btrfs/volumes.c | 8 +++++---
>>   1 file changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
>> index 83e2834ea273..a1f0fccd552c 100644
>> --- a/fs/btrfs/volumes.c
>> +++ b/fs/btrfs/volumes.c
>> @@ -7082,7 +7082,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
>>
>>                  ret = btrfs_translate_remap(fs_info, &new_logical, length);
>>                  if (ret)
>> -                       return ret;
>> +                       goto out;
> 
> For this hunk:
> 
> Fixes: 18ba64992871 ("btrfs: redirect I/O for remapped block groups")
> 
>>
>>                  if (new_logical != logical) {
>>                          btrfs_free_chunk_map(map);
>> @@ -7096,8 +7096,10 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
>>          }
>>
>>          num_copies = btrfs_chunk_map_num_copies(map);
>> -       if (io_geom.mirror_num > num_copies)
>> -               return -EINVAL;
>> +       if (io_geom.mirror_num > num_copies) {
>> +               ret = -EINVAL;
>> +               goto out;
>> +       }
> 
> For this hunk:
> 
> Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()")
> 
> I would suggest splitting this into 2 different patches, each one with
> the respective Fixes tag so that the second leak can be backported
> more easily.

Thanks Filipe, I'll do just that. Please ignore this one.

> 
>>
>>          map_offset = logical - map->start;
>>          io_geom.raid56_full_stripe_start = (u64)-1;
>> --
>> 2.52.0
>>
>>