Forwarded: [PATCH] btrfs: qgroup: fix memory leak when add_qgroup_item() fails

[syzbot <syzbot+803e4cb8245b52928347@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] btrfs: qgroup: fix memory leak when add_qgroup_item() fails
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

If add_qgroup_item() fails, we jump to the out label without freeing the
preallocated qgroup structure. This causes a memory leak and triggers
the ASSERT(prealloc == NULL) assertion.

Fix this by freeing prealloc and setting it to NULL before jumping to
the out label when add_qgroup_item() fails.

Reported-by: syzbot+803e4cb8245b52928347@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=803e4cb8245b52928347
Fixes: 8d54518b5e52 ("btrfs: qgroup: pre-allocate btrfs_qgroup to reduce GFP_ATOMIC usage")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/btrfs/qgroup.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e2b53e90dcb..4dbf6d2d2aaa 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1671,8 +1671,11 @@ int btrfs_create_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid)
 	}
 
 	ret = add_qgroup_item(trans, quota_root, qgroupid);
-	if (ret)
+	if (ret) {
+		kfree(prealloc);
+		prealloc = NULL;
 		goto out;
+	}
 
 	spin_lock(&fs_info->qgroup_lock);
 	qgroup = add_qgroup_rb(fs_info, prealloc, qgroupid);
-- 
2.43.0