[PATCH] btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()

[PATCH] btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()

[Mark Harmstone]

Fix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL,
we're not freeing the chunk map that we've just looked up.

Signed-off-by: Mark Harmstone <mark@harmstone.com>
Cc: stable@vger.kernel.org
Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()")
---
 fs/btrfs/volumes.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1bd3464ccdd8..a1f0fccd552c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7096,8 +7096,10 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
 	}
 
 	num_copies = btrfs_chunk_map_num_copies(map);
-	if (io_geom.mirror_num > num_copies)
-		return -EINVAL;
+	if (io_geom.mirror_num > num_copies) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	map_offset = logical - map->start;
 	io_geom.raid56_full_stripe_start = (u64)-1;
-- 
2.52.0

Re: [PATCH] btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()

[Filipe Manana]

On Fri, Feb 20, 2026 at 1:02 PM Mark Harmstone <mark@harmstone.com> wrote:
>
> Fix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL,
> we're not freeing the chunk map that we've just looked up.
>
> Signed-off-by: Mark Harmstone <mark@harmstone.com>
> Cc: stable@vger.kernel.org
> Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()")

Reviewed-by: Filipe Manana <fdmanana@suse.com>

Side note: if there's a Fixes tag, we don't need a CC stable tag
anymore nowadays.



> ---
>  fs/btrfs/volumes.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 1bd3464ccdd8..a1f0fccd552c 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -7096,8 +7096,10 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
>         }
>
>         num_copies = btrfs_chunk_map_num_copies(map);
> -       if (io_geom.mirror_num > num_copies)
> -               return -EINVAL;
> +       if (io_geom.mirror_num > num_copies) {
> +               ret = -EINVAL;
> +               goto out;
> +       }
>
>         map_offset = logical - map->start;
>         io_geom.raid56_full_stripe_start = (u64)-1;
> --
> 2.52.0
>

Re: [PATCH] btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()

[Greg KH]

On Fri, Feb 20, 2026 at 01:07:27PM +0000, Filipe Manana wrote:
> On Fri, Feb 20, 2026 at 1:02 PM Mark Harmstone <mark@harmstone.com> wrote:
> >
> > Fix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL,
> > we're not freeing the chunk map that we've just looked up.
> >
> > Signed-off-by: Mark Harmstone <mark@harmstone.com>
> > Cc: stable@vger.kernel.org
> > Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()")
> 
> Reviewed-by: Filipe Manana <fdmanana@suse.com>
> 
> Side note: if there's a Fixes tag, we don't need a CC stable tag
> anymore nowadays.

Not true at all, please read:

    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

You HAVE to have a cc: stable if you know you want it to be added to a
stable tree.  If you do not do that, you are at the mercy of "when Greg
and Sasha get bored and attempt to pick up things that maintainers
forgot about".

thanks,

greg k-h