On Tue, Nov 4, 2025 at 1:21 PM Zhen Ni zhen.ni@easystack.cn wrote:
When check_next_block_uptodate() fails, do_walk_down() returns directly without cleaning up the locked extent buffer allocated earlier, causing memory and lock leaks.
Fix by using the existing out_unlock cleanup path instead of direct return.
Fixes: 562d425454e8 ("btrfs: factor out eb uptodate check from do_walk_down()") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni zhen.ni@easystack.cn
fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index dc4ca98c3780..742e476bf815 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5770,7 +5770,7 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
ret = check_next_block_uptodate(trans, root, path, wc, next); if (ret)
return ret;
goto out_unlock;
This is wrong and will cause a double unlock and double free.
When check_next_block_uptodate() returns an error, it has already unlocked and freed the extent buffer.
Thanks.
level--; ASSERT(level == btrfs_header_level(next));-- 2.20.1