Re: [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root()

[Boris Burkov <boris@bur.io>]

On Fri, Sep 18, 2026 at 05:49:14PM +0100, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> If in btrfs_tree_mod_log_insert_root() there is an error in the call to
> tree_mod_log_insert() (the only possible error is -EEXIST, which means we
> have a bug or some memory corruption maybe) we free all the nodes in the
> 'tm_list' array but we don't remove them from the tree-mod-log rbtree,
> which can result in use-after-free bugs later.
> 
> So make sure we remove the nodes from the rbtree before freeing them after
> an error.
> 
> Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
> Assisted-by: LLM (found the bug)
Reviewed-by: Boris Burkov <boris@bur.io>
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
>  fs/btrfs/tree-mod-log.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c
> index a8094928f4c9..f2a00a7df1cd 100644
> --- a/fs/btrfs/tree-mod-log.c
> +++ b/fs/btrfs/tree-mod-log.c
> @@ -498,8 +498,11 @@ int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root,
>  
>  free_tms:
>  	if (tm_list) {
> -		for (i = 0; i < nritems; i++)
> +		for (i = 0; i < nritems; i++) {
> +			if (tm_list[i] && !RB_EMPTY_NODE(&tm_list[i]->node))
> +				rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
>  			kfree(tm_list[i]);
> +		}
>  		kfree(tm_list);
>  	}
>  	kfree(tm);
> -- 
> 2.47.2
>