[PATCH 0/3] btrfs: fix io_uring encoded read cleanup paths

[PATCH 0/3] btrfs: fix io_uring encoded read cleanup paths

[Yang Xiuwei]

Three related bugs in the io_uring ENCODED_READ path:

1. pages array allocation failure returned -ENOMEM without unlocking
   the inode and extent locks taken by btrfs_encoded_read().

2. If bios completed before fill_pages returned, endio already queued
   btrfs_uring_read_finished(), but a negative I/O status made the
   caller clean up as well.  This matches the GPF reported by Yue Sun;
   patch 2 follows Jens Axboe's suggestion.

   Link: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/

3. After btrfs_uring_read_extent() failed, the caller skipped
   kfree(data->iov) by always jumping to out_acct.

Yang Xiuwei (3):
  btrfs: unlock inode and extent on pages alloc failure in uring read
  btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
  btrfs: free iov when btrfs_uring_read_extent fails

 fs/btrfs/inode.c |  7 +++----
 fs/btrfs/ioctl.c | 18 +++++++++++-------
 2 files changed, 14 insertions(+), 11 deletions(-)

-- 
2.25.1

[PATCH 1/3] btrfs: unlock inode and extent on pages alloc failure in uring read

[Yang Xiuwei]

btrfs_uring_read_extent() is only reached after btrfs_encoded_read()
has taken the inode shared lock and the extent lock.  If allocating
the pages array fails it returned -ENOMEM directly and left both
locks held.

Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
 fs/btrfs/ioctl.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 68b33f365fda..c953e4409d5b 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4626,8 +4626,10 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
 
 	nr_pages = DIV_ROUND_UP(disk_io_size, PAGE_SIZE);
 	pages = kzalloc_objs(struct page *, nr_pages, GFP_NOFS);
-	if (!pages)
-		return -ENOMEM;
+	if (!pages) {
+		ret = -ENOMEM;
+		goto out_fail;
+	}
 	ret = btrfs_alloc_page_array(nr_pages, pages, GFP_NOFS);
 	if (ret) {
 		ret = -ENOMEM;
@@ -4677,9 +4679,11 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
 	btrfs_unlock_extent(io_tree, start, lockend, &cached_state);
 	btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
 	kfree(priv);
-	for (int i = 0; i < nr_pages; i++) {
-		if (pages[i])
-			__free_page(pages[i]);
+	if (pages) {
+		for (int i = 0; i < nr_pages; i++) {
+			if (pages[i])
+				__free_page(pages[i]);
+		}
 	}
 	kfree(pages);
 	return ret;
-- 
2.25.1

Re: [PATCH 1/3] btrfs: unlock inode and extent on pages alloc failure in uring read

[Qu Wenruo]

在 2026/8/5 11:41, Yang Xiuwei 写道:
> btrfs_uring_read_extent() is only reached after btrfs_encoded_read()
> has taken the inode shared lock and the extent lock.  If allocating
> the pages array fails it returned -ENOMEM directly and left both
> locks held.
> 
> Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> ---
>   fs/btrfs/ioctl.c | 14 +++++++++-----
>   1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 68b33f365fda..c953e4409d5b 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -4626,8 +4626,10 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
>   
>   	nr_pages = DIV_ROUND_UP(disk_io_size, PAGE_SIZE);
>   	pages = kzalloc_objs(struct page *, nr_pages, GFP_NOFS);
> -	if (!pages)
> -		return -ENOMEM;
> +	if (!pages) {
> +		ret = -ENOMEM;
> +		goto out_fail;

The extra handling is only to unlock the inode and extent io tree.

And neither the inode nor extent io tree is locked by the function 
itself, but btrfs_encoded_read().

I do not believe this is the correct location to unlock inode/extent io 
tree.

Move the unlock into the caller, as the caller is already doing such 
unlock after copy_to_user() failed.

> +	}
>   	ret = btrfs_alloc_page_array(nr_pages, pages, GFP_NOFS);
>   	if (ret) {
>   		ret = -ENOMEM;
> @@ -4677,9 +4679,11 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
>   	btrfs_unlock_extent(io_tree, start, lockend, &cached_state);
>   	btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
>   	kfree(priv);
> -	for (int i = 0; i < nr_pages; i++) {
> -		if (pages[i])
> -			__free_page(pages[i]);
> +	if (pages) {
> +		for (int i = 0; i < nr_pages; i++) {
> +			if (pages[i])
> +				__free_page(pages[i]);
> +		}
>   	}
>   	kfree(pages);
>   	return ret;

Re: [PATCH 1/3] btrfs: unlock inode and extent on pages alloc failure in uring read

[Yang Xiuwei]

Hi Wenruo,

On 2026/8/5 12:49, Qu Wenruo wrote:
> The extra handling is only to unlock the inode and extent io tree.
>
> And neither the inode nor extent io tree is locked by the function
> itself, but btrfs_encoded_read().
>
> I do not believe this is the correct location to unlock inode/extent io
> tree.
>
> Move the unlock into the caller, as the caller is already doing such
> unlock after copy_to_user() failed.

Right, will move the unlock to the caller in v2.

Thanks,
Yang Xiuwei

[PATCH 2/3] btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

[Yang Xiuwei]

If all bios finish before btrfs_encoded_read_regular_fill_pages()
returns, it calls btrfs_uring_read_extent_endio() and previously
returned the I/O status.  A negative errno then made
btrfs_uring_read_extent() unlock and free while
btrfs_uring_read_finished() did the same again.

Return -EIOCBQUEUED so only the deferred path cleans up.

Reported-by: Yue Sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/
Suggested-by: Jens Axboe <axboe@kernel.dk>
Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
 fs/btrfs/inode.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b446c3014b24..8e3cee3845e6 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9411,7 +9411,6 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 	struct completion sync_reads;
 	unsigned long i = 0;
 	struct btrfs_bio *bbio;
-	int ret;
 
 	/*
 	 * Fast path for synchronous reads which completes in this call, io_uring
@@ -9458,10 +9457,10 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 
 	if (uring_ctx) {
 		if (refcount_dec_and_test(&priv->pending_refs)) {
-			ret = blk_status_to_errno(READ_ONCE(priv->status));
-			btrfs_uring_read_extent_endio(uring_ctx, ret);
+			int err = blk_status_to_errno(READ_ONCE(priv->status));
+
+			btrfs_uring_read_extent_endio(uring_ctx, err);
 			kfree(priv);
-			return ret;
 		}
 
 		return -EIOCBQUEUED;
-- 
2.25.1

Re: [PATCH 2/3] btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

[Qu Wenruo]

在 2026/8/5 11:41, Yang Xiuwei 写道:
> If all bios finish before btrfs_encoded_read_regular_fill_pages()
> returns, it calls btrfs_uring_read_extent_endio() and previously
> returned the I/O status.  A negative errno then made
> btrfs_uring_read_extent() unlock and free while
> btrfs_uring_read_finished() did the same again.
> 
> Return -EIOCBQUEUED so only the deferred path cleans up.
> 
> Reported-by: Yue Sun <samsun1006219@gmail.com>
> Closes: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/
> Suggested-by: Jens Axboe <axboe@kernel.dk>
> Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>

Sashiko is reporting errors on pre-existing problems for this and the 
next patch:

https://sashiko.dev/#/patchset/20260805021135.1896609-1-yangxiuwei%40kylinos.cn

I believe they are worth addressing since you're touching the error 
handling.


> ---
>   fs/btrfs/inode.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index b446c3014b24..8e3cee3845e6 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -9411,7 +9411,6 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
>   	struct completion sync_reads;
>   	unsigned long i = 0;
>   	struct btrfs_bio *bbio;
> -	int ret;
>   
>   	/*
>   	 * Fast path for synchronous reads which completes in this call, io_uring
> @@ -9458,10 +9457,10 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
>   
>   	if (uring_ctx) {
>   		if (refcount_dec_and_test(&priv->pending_refs)) {
> -			ret = blk_status_to_errno(READ_ONCE(priv->status));
> -			btrfs_uring_read_extent_endio(uring_ctx, ret);
> +			int err = blk_status_to_errno(READ_ONCE(priv->status));
> +
> +			btrfs_uring_read_extent_endio(uring_ctx, err);
>   			kfree(priv);
> -			return ret;
>   		}
>   
>   		return -EIOCBQUEUED;

Re: [PATCH 2/3] btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

[Yang Xiuwei]

Hi Wenruo,

On 2026/8/5 12:51, Qu Wenruo wrote:
> Sashiko is reporting errors on pre-existing problems for this and the
> next patch:
>
> https://sashiko.dev/#/patchset/20260805021135.1896609-1-yangxiuwei%40kylinos.cn
>
> I believe they are worth addressing since you're touching the error
> handling.

Will check those and include the relevant fixes in v2.

Thanks,
Yang Xiuwei

[PATCH 3/3] btrfs: free iov when btrfs_uring_read_extent fails

[Yang Xiuwei]

After btrfs_uring_read_extent(), the caller always jumped to out_acct.
That skips kfree(data->iov), which is only correct for -EIOCBQUEUED
where the deferred path owns the iov. On failure, fall through to
out_free instead.

Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
 fs/btrfs/ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c953e4409d5b..af5e168068d3 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4820,8 +4820,8 @@ static int btrfs_uring_encoded_read(struct io_uring_cmd *cmd, unsigned int issue
 					      cached_state, disk_bytenr, disk_io_size,
 					      count, data->args.compression,
 					      data->iov, cmd);
-
-		goto out_acct;
+		if (ret == -EIOCBQUEUED)
+			goto out_acct;
 	}
 
 out_free:
-- 
2.25.1