FAILED: patch "[PATCH] btrfs: fix the inode leak in btrfs_iget()" failed to apply to 6.14-stable tree

FAILED: patch "[PATCH] btrfs: fix the inode leak in btrfs_iget()" failed to apply to 6.14-stable tree

[gregkh]

The patch below does not apply to the 6.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.14.y
git checkout FETCH_HEAD
git cherry-pick -x 48c1d1bb525b1c44b8bdc8e7ec5629cb6c2b9fc4
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2025050558-charger-crumpled-6ca4@gregkh' --subject-prefix 'PATCH 6.14.y' HEAD^..

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 48c1d1bb525b1c44b8bdc8e7ec5629cb6c2b9fc4 Mon Sep 17 00:00:00 2001
From: Penglei Jiang <superman.xpt@gmail.com>
Date: Mon, 21 Apr 2025 08:40:29 -0700
Subject: [PATCH] btrfs: fix the inode leak in btrfs_iget()

[BUG]
There is a bug report that a syzbot reproducer can lead to the following
busy inode at unmount time:

  BTRFS info (device loop1): last unmount of filesystem 1680000e-3c1e-4c46-84b6-56bd3909af50
  VFS: Busy inodes after unmount of loop1 (btrfs)
  ------------[ cut here ]------------
  kernel BUG at fs/super.c:650!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  CPU: 0 UID: 0 PID: 48168 Comm: syz-executor Not tainted 6.15.0-rc2-00471-g119009db2674 #2 PREEMPT(full)
  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  RIP: 0010:generic_shutdown_super+0x2e9/0x390 fs/super.c:650
  Call Trace:
   <TASK>
   kill_anon_super+0x3a/0x60 fs/super.c:1237
   btrfs_kill_super+0x3b/0x50 fs/btrfs/super.c:2099
   deactivate_locked_super+0xbe/0x1a0 fs/super.c:473
   deactivate_super fs/super.c:506 [inline]
   deactivate_super+0xe2/0x100 fs/super.c:502
   cleanup_mnt+0x21f/0x440 fs/namespace.c:1435
   task_work_run+0x14d/0x240 kernel/task_work.c:227
   resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
   exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
   syscall_exit_to_user_mode+0x269/0x290 kernel/entry/common.c:218
   do_syscall_64+0xd4/0x250 arch/x86/entry/syscall_64.c:100
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

[CAUSE]
When btrfs_alloc_path() failed, btrfs_iget() directly returned without
releasing the inode already allocated by btrfs_iget_locked().

This results the above busy inode and trigger the kernel BUG.

[FIX]
Fix it by calling iget_failed() if btrfs_alloc_path() failed.

If we hit error inside btrfs_read_locked_inode(), it will properly call
iget_failed(), so nothing to worry about.

Although the iget_failed() cleanup inside btrfs_read_locked_inode() is a
break of the normal error handling scheme, let's fix the obvious bug
and backport first, then rework the error handling later.

Reported-by: Penglei Jiang <superman.xpt@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/20250421102425.44431-1-superman.xpt@gmail.com/
Fixes: 7c855e16ab72 ("btrfs: remove conditional path allocation in btrfs_read_locked_inode()")
CC: stable@vger.kernel.org # 6.13+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 312fa996a987..d295a37fa049 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5682,8 +5682,10 @@ struct btrfs_inode *btrfs_iget(u64 ino, struct btrfs_root *root)
 		return inode;
 
 	path = btrfs_alloc_path();
-	if (!path)
+	if (!path) {
+		iget_failed(&inode->vfs_inode);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	ret = btrfs_read_locked_inode(inode, path);
 	btrfs_free_path(path);

[PATCH v2 6.14.y] btrfs: fix the inode leak in btrfs_iget()

[Penglei Jiang]

The commit 48c1d1bb525b1c44b8bdc8e7ec5629cb6c2b9fc4 fails to compile
in kernel version 6.14.

Version 6.14:
    struct inode *btrfs_iget(u64 ino, struct btrfs_root *root)
    {
            struct inode *inode;
            ~~~~~~~~~~~~~~
            ...
            inode = btrfs_iget_locked(ino, root);
            ...
    }

Version 6.15:
    struct btrfs_inode *btrfs_iget(u64 ino, struct btrfs_root *root)
    {
            struct btrfs_inode *inode;
            ~~~~~~~~~~~~~~~~~~~~
            ...
            inode = btrfs_iget_locked(ino, root);
            ...
    }

In kernel version 6.14, the function btrfs_iget_locked() returns a
struct inode *, so the patch code adjusts to use iget_failed(inode).

Reported-by: Penglei Jiang <superman.xpt@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/20250421102425.44431-1-superman.xpt@gmail.com/
Fixes: 7c855e16ab72 ("btrfs: remove conditional path allocation in btrfs_read_locked_inode()")
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
 fs/btrfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ad7009d336fa..d2edb2201e3a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5660,7 +5660,7 @@ struct inode *btrfs_iget(u64 ino, struct btrfs_root *root)
 
 	path = btrfs_alloc_path();
 	if (!path) {
-		iget_failed(&inode->vfs_inode);
+		iget_failed(inode);
 		return ERR_PTR(-ENOMEM);
 	}
 
-- 
2.17.1

Re: [PATCH v2 6.14.y] btrfs: fix the inode leak in btrfs_iget()

[Greg KH]

On Mon, May 05, 2025 at 08:03:22AM -0700, Penglei Jiang wrote:
> The commit 48c1d1bb525b1c44b8bdc8e7ec5629cb6c2b9fc4 fails to compile
> in kernel version 6.14.
> 
> Version 6.14:
>     struct inode *btrfs_iget(u64 ino, struct btrfs_root *root)
>     {
>             struct inode *inode;
>             ~~~~~~~~~~~~~~
>             ...
>             inode = btrfs_iget_locked(ino, root);
>             ...
>     }
> 
> Version 6.15:
>     struct btrfs_inode *btrfs_iget(u64 ino, struct btrfs_root *root)
>     {
>             struct btrfs_inode *inode;
>             ~~~~~~~~~~~~~~~~~~~~
>             ...
>             inode = btrfs_iget_locked(ino, root);
>             ...
>     }
> 
> In kernel version 6.14, the function btrfs_iget_locked() returns a
> struct inode *, so the patch code adjusts to use iget_failed(inode).
> 
> Reported-by: Penglei Jiang <superman.xpt@gmail.com>
> Link: https://lore.kernel.org/linux-btrfs/20250421102425.44431-1-superman.xpt@gmail.com/
> Fixes: 7c855e16ab72 ("btrfs: remove conditional path allocation in btrfs_read_locked_inode()")
> Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
> ---
>  fs/btrfs/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

This is not a v2, it is a totally different patch.

Please just fix up your original backport to build properly when you
submit it, don't send a "fix up patch" to solve a build problem a
previous patch added.

thanks,

greg k-h

Re: [PATCH v2 6.14.y] btrfs: fix the inode leak in btrfs_iget()

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues:
⚠️ Found matching upstream commit but patch is missing proper reference to it

Found matching upstream commit: 48c1d1bb525b1c44b8bdc8e7ec5629cb6c2b9fc4

Note: The patch differs from the upstream commit:
---
1:  48c1d1bb525b1 < -:  ------------- btrfs: fix the inode leak in btrfs_iget()
-:  ------------- > 1:  aeaee199900ee Linux 6.14.5
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.14.y       |  Success    |  Success   |