[PATCH 0/3] btrfs: fix io_uring encoded read cleanup paths

[Yang Xiuwei <yangxiuwei@kylinos.cn>]

Three related bugs in the io_uring ENCODED_READ path:

1. pages array allocation failure returned -ENOMEM without unlocking
   the inode and extent locks taken by btrfs_encoded_read().

2. If bios completed before fill_pages returned, endio already queued
   btrfs_uring_read_finished(), but a negative I/O status made the
   caller clean up as well.  This matches the GPF reported by Yue Sun;
   patch 2 follows Jens Axboe's suggestion.

   Link: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/

3. After btrfs_uring_read_extent() failed, the caller skipped
   kfree(data->iov) by always jumping to out_acct.

Yang Xiuwei (3):
  btrfs: unlock inode and extent on pages alloc failure in uring read
  btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
  btrfs: free iov when btrfs_uring_read_extent fails

 fs/btrfs/inode.c |  7 +++----
 fs/btrfs/ioctl.c | 18 +++++++++++-------
 2 files changed, 14 insertions(+), 11 deletions(-)

-- 
2.25.1