From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Filipe Manana <fdmanana@suse.com>, Boris Burkov <boris@bur.io>,
Qu Wenruo <wqu@suse.com>, David Sterba <dsterba@suse.com>,
Sasha Levin <sashal@kernel.org>,
clm@fb.com, josef@toxicpanda.com, linux-btrfs@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 20/27] btrfs: qgroup: fix quota root leak after quota disable failure
Date: Tue, 9 Jul 2024 12:23:34 -0400 [thread overview]
Message-ID: <20240709162401.31946-20-sashal@kernel.org> (raw)
In-Reply-To: <20240709162401.31946-1-sashal@kernel.org>
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit a7e4c6a3031c74078dba7fa36239d0f4fe476c53 ]
If during the quota disable we fail when cleaning the quota tree or when
deleting the root from the root tree, we jump to the 'out' label without
ever dropping the reference on the quota root, resulting in a leak of the
root since fs_info->quota_root is no longer pointing to the root (we have
set it to NULL just before those steps).
Fix this by always doing a btrfs_put_root() call under the 'out' label.
This is a problem that exists since qgroups were first added in 2012 by
commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but
back then we missed a kfree on the quota root and free_extent_buffer()
calls on its root and commit root nodes, since back then roots were not
yet reference counted.
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/qgroup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 80ca7b435b0d1..e482889667ec9 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1222,7 +1222,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
{
- struct btrfs_root *quota_root;
+ struct btrfs_root *quota_root = NULL;
struct btrfs_trans_handle *trans = NULL;
int ret = 0;
@@ -1317,9 +1317,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
btrfs_free_tree_block(trans, btrfs_root_id(quota_root),
quota_root->node, 0, 1);
- btrfs_put_root(quota_root);
out:
+ btrfs_put_root(quota_root);
mutex_unlock(&fs_info->qgroup_ioctl_lock);
if (ret && trans)
btrfs_end_transaction(trans);
--
2.43.0
next prev parent reply other threads:[~2024-07-09 16:24 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-09 16:23 [PATCH AUTOSEL 6.1 01/27] Input: elantech - fix touchpad state on resume for Lenovo N24 Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 02/27] Input: i8042 - add Ayaneo Kun to i8042 quirk table Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 03/27] ASoC: topology: Fix references to freed memory Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 04/27] ASoC: topology: Do not assign fields that are already set Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 05/27] ASoC: topology: Clean up route loading Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 06/27] bytcr_rt5640 : inverse jack detect for Archos 101 cesium Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 07/27] ALSA: dmaengine: Synchronize dma channel after drop() Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 08/27] ASoC: ti: davinci-mcasp: Set min period size using FIFO config Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 09/27] ASoC: ti: omap-hdmi: Fix too long driver name Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 10/27] ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 11/27] ASoC: topology: Fix route memory corruption Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 12/27] can: kvaser_usb: fix return value for hif_usb_send_regout Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 13/27] gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 14/27] s390/sclp: Fix sclp_init() cleanup on failure Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 15/27] platform/mellanox: nvsw-sn2201: Add check for platform_device_add_resources Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 16/27] platform/x86: wireless-hotkey: Add support for LG Airplane Button Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 17/27] platform/x86: lg-laptop: Remove LGEX0815 hotkey handling Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 18/27] platform/x86: lg-laptop: Change ACPI device id Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 19/27] platform/x86: lg-laptop: Use ACPI device handle when evaluating WMAB/WMBB Sasha Levin
2024-07-09 16:23 ` Sasha Levin [this message]
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 21/27] ibmvnic: Add tx check to prevent skb leak Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 22/27] ALSA: PCM: Allow resume only for suspended streams Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 23/27] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 24/27] ALSA: dmaengine_pcm: terminate dmaengine before synchronize Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 25/27] parisc: use generic sys_fanotify_mark implementation Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 26/27] ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA Sasha Levin
2024-07-09 16:23 ` [PATCH AUTOSEL 6.1 27/27] net: usb: qmi_wwan: add Telit FN912 compositions Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240709162401.31946-20-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=boris@bur.io \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=fdmanana@suse.com \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=wqu@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).