data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain
local_root, but fails to release its reference when paths_from_inode()
returns an error. This causes a potential memory leak.

Add a missing btrfs_put_root() call in the error path to properly
decrease the reference count of local_root.

Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 fs/btrfs/inode.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3df5f36185a0..6282911e536f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -177,8 +177,10 @@ static int data_reloc_print_warning_inode(u64 inum, u64 offset, u64 num_bytes,
 		return ret;
 	}
 	ret = paths_from_inode(inum, ipath);
-	if (ret < 0)
+	if (ret < 0) {
+		btrfs_put_root(local_root);
 		goto err;
+	}
 
 	/*
 	 * We deliberately ignore the bit ipath might have been too small to
-- 
2.34.1

在 2025/11/5 13:07, Zilin Guan 写道:
> data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain
> local_root, but fails to release its reference when paths_from_inode()
> returns an error. This causes a potential memory leak.
> 
> Add a missing btrfs_put_root() call in the error path to properly
> decrease the reference count of local_root.
> 
> Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails")
> Signed-off-by: Zilin Guan <zilin@seu.edu.cn>

Reviewed-by: Qu Wenruo <wqu@suse.com>

Now merged into for-next branch.

Thanks,
Qu

> ---
>   fs/btrfs/inode.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 3df5f36185a0..6282911e536f 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -177,8 +177,10 @@ static int data_reloc_print_warning_inode(u64 inum, u64 offset, u64 num_bytes,
>   		return ret;
>   	}
>   	ret = paths_from_inode(inum, ipath);
> -	if (ret < 0)
> +	if (ret < 0) {
> +		btrfs_put_root(local_root);
>   		goto err;
> +	}
>   
>   	/*
>   	 * We deliberately ignore the bit ipath might have been too small to