* [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root()
@ 2026-09-18 16:49 fdmanana
2026-09-18 17:04 ` Boris Burkov
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: fdmanana @ 2026-09-18 16:49 UTC (permalink / raw)
To: linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
If in btrfs_tree_mod_log_insert_root() there is an error in the call to
tree_mod_log_insert() (the only possible error is -EEXIST, which means we
have a bug or some memory corruption maybe) we free all the nodes in the
'tm_list' array but we don't remove them from the tree-mod-log rbtree,
which can result in use-after-free bugs later.
So make sure we remove the nodes from the rbtree before freeing them after
an error.
Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
Assisted-by: LLM (found the bug)
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
fs/btrfs/tree-mod-log.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c
index a8094928f4c9..f2a00a7df1cd 100644
--- a/fs/btrfs/tree-mod-log.c
+++ b/fs/btrfs/tree-mod-log.c
@@ -498,8 +498,11 @@ int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root,
free_tms:
if (tm_list) {
- for (i = 0; i < nritems; i++)
+ for (i = 0; i < nritems; i++) {
+ if (tm_list[i] && !RB_EMPTY_NODE(&tm_list[i]->node))
+ rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
kfree(tm_list[i]);
+ }
kfree(tm_list);
}
kfree(tm);
--
2.47.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root()
2026-09-18 16:49 [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root() fdmanana
@ 2026-09-18 17:04 ` Boris Burkov
2026-09-18 17:27 ` [PATCH v2] " fdmanana
2026-09-18 17:46 ` [PATCH v3] " fdmanana
2 siblings, 0 replies; 4+ messages in thread
From: Boris Burkov @ 2026-09-18 17:04 UTC (permalink / raw)
To: fdmanana; +Cc: linux-btrfs
On Fri, Sep 18, 2026 at 05:49:14PM +0100, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
>
> If in btrfs_tree_mod_log_insert_root() there is an error in the call to
> tree_mod_log_insert() (the only possible error is -EEXIST, which means we
> have a bug or some memory corruption maybe) we free all the nodes in the
> 'tm_list' array but we don't remove them from the tree-mod-log rbtree,
> which can result in use-after-free bugs later.
>
> So make sure we remove the nodes from the rbtree before freeing them after
> an error.
>
> Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
> Assisted-by: LLM (found the bug)
Reviewed-by: Boris Burkov <boris@bur.io>
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
> fs/btrfs/tree-mod-log.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c
> index a8094928f4c9..f2a00a7df1cd 100644
> --- a/fs/btrfs/tree-mod-log.c
> +++ b/fs/btrfs/tree-mod-log.c
> @@ -498,8 +498,11 @@ int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root,
>
> free_tms:
> if (tm_list) {
> - for (i = 0; i < nritems; i++)
> + for (i = 0; i < nritems; i++) {
> + if (tm_list[i] && !RB_EMPTY_NODE(&tm_list[i]->node))
> + rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
> kfree(tm_list[i]);
> + }
> kfree(tm_list);
> }
> kfree(tm);
> --
> 2.47.2
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root()
2026-09-18 16:49 [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root() fdmanana
2026-09-18 17:04 ` Boris Burkov
@ 2026-09-18 17:27 ` fdmanana
2026-09-18 17:46 ` [PATCH v3] " fdmanana
2 siblings, 0 replies; 4+ messages in thread
From: fdmanana @ 2026-09-18 17:27 UTC (permalink / raw)
To: linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
If in btrfs_tree_mod_log_insert_root() there is an error in the call to
tree_mod_log_insert() (the only possible error is -EEXIST, which means we
have a bug or some memory corruption maybe) we free all the nodes in the
'tm_list' array but we don't remove them from the tree-mod-log rbtree,
which can result in use-after-free bugs later.
So make sure we remove the nodes from the rbtree before freeing them after
an error.
Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
Assisted-by: LLM (found the bug)
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
V2: Fix racy removal from rbtree on error (not holding the lock
fs_info->tree_mod_log_lock).
fs/btrfs/tree-mod-log.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c
index a8094928f4c9..9536ab0449e0 100644
--- a/fs/btrfs/tree-mod-log.c
+++ b/fs/btrfs/tree-mod-log.c
@@ -483,10 +483,17 @@ int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root,
goto out_unlock;
}
- if (tm_list)
+ if (tm_list) {
ret = tree_mod_log_free_eb(fs_info, tm_list, nritems);
- if (!ret)
- ret = tree_mod_log_insert(fs_info, tm);
+ if (ret)
+ goto free_tms;
+ }
+
+ ret = tree_mod_log_insert(fs_info, tm);
+ if (ret && tm_list) {
+ for (i = 0; i < nritems; i++)
+ rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
+ }
out_unlock:
write_unlock(&fs_info->tree_mod_log_lock);
--
2.47.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v3] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root()
2026-09-18 16:49 [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root() fdmanana
2026-09-18 17:04 ` Boris Burkov
2026-09-18 17:27 ` [PATCH v2] " fdmanana
@ 2026-09-18 17:46 ` fdmanana
2 siblings, 0 replies; 4+ messages in thread
From: fdmanana @ 2026-09-18 17:46 UTC (permalink / raw)
To: linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
If in btrfs_tree_mod_log_insert_root() there is an error in the call to
tree_mod_log_insert() (the only possible error is -EEXIST, which means we
have a bug or some memory corruption maybe) we free all the nodes in the
'tm_list' array but we don't remove them from the tree-mod-log rbtree,
which can result in use-after-free bugs later.
So make sure we remove the nodes from the rbtree before freeing them after
an error.
Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
Assisted-by: LLM (found the bug)
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
V3: Fix wrong label to jump on error (shashiko).
V2: Fix racy removal from rbtree on error (not holding the lock
fs_info->tree_mod_log_lock).
fs/btrfs/tree-mod-log.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/fs/btrfs/tree-mod-log.c b/fs/btrfs/tree-mod-log.c
index a8094928f4c9..bfa348d6483f 100644
--- a/fs/btrfs/tree-mod-log.c
+++ b/fs/btrfs/tree-mod-log.c
@@ -483,10 +483,17 @@ int btrfs_tree_mod_log_insert_root(struct extent_buffer *old_root,
goto out_unlock;
}
- if (tm_list)
+ if (tm_list) {
ret = tree_mod_log_free_eb(fs_info, tm_list, nritems);
- if (!ret)
- ret = tree_mod_log_insert(fs_info, tm);
+ if (ret)
+ goto out_unlock;
+ }
+
+ ret = tree_mod_log_insert(fs_info, tm);
+ if (ret && tm_list) {
+ for (i = 0; i < nritems; i++)
+ rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
+ }
out_unlock:
write_unlock(&fs_info->tree_mod_log_lock);
--
2.47.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-18 17:46 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-18 16:49 [PATCH] btrfs: fix dangling nodes in tree-mod-log after error in btrfs_tree_mod_log_insert_root() fdmanana
2026-09-18 17:04 ` Boris Burkov
2026-09-18 17:27 ` [PATCH v2] " fdmanana
2026-09-18 17:46 ` [PATCH v3] " fdmanana
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox