Re: [PATCH] btrfs: fix double free in create_space_info_sub_group() error path

[Qu Wenruo <wqu@suse.com>]

在 2026/4/1 21:32, Guangshuo Li 写道:
> When kobject_init_and_add() fails, the call chain is:
> 
> create_space_info_sub_group()
> -> btrfs_sysfs_add_space_info_type()
> -> kobject_init_and_add()
> -> failure
> -> kobject_put(&sub_group->kobj)
> -> space_info_release()
> -> kfree(sub_group)
> 
> Then control returns to create_space_info_sub_group(), where:
> 
> btrfs_sysfs_add_space_info_type() returns error
> -> kfree(sub_group)
> 
> Thus, sub_group is freed twice.
> 
> Keep parent->sub_group[index] = NULL for the failure path, but after
> btrfs_sysfs_add_space_info_type() has called kobject_put(), let the
> kobject release callback handle the cleanup.
> 
> Fixes: f92ee31e031c ("btrfs: introduce btrfs_space_info sub-group")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

> ---
>   fs/btrfs/space-info.c | 1 -
>   1 file changed, 1 deletion(-)
> 
> diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
> index d7176eb2fcbf..f5d0f587b755 100644
> --- a/fs/btrfs/space-info.c
> +++ b/fs/btrfs/space-info.c
> @@ -277,7 +277,6 @@ static int create_space_info_sub_group(struct btrfs_space_info *parent, u64 flag
>   
>   	ret = btrfs_sysfs_add_space_info_type(sub_group);
>   	if (ret) {
> -		kfree(sub_group);
>   		parent->sub_group[index] = NULL;
>   	}

For single line operation inside a if branch, we do not need the 
brackets anymore.

I'll remove them during merge so you don't need to resend the patch.

Thanks,
Qu
>   	return ret;