From nobody Mon Jun 8 09:49:26 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 914473E9C33 for ; Thu, 4 Jun 2026 12:14:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780575264; cv=none; b=UjRLvct9g12WE2wBfDrx4izANo+CKb9sxLJI8HqK4/SQOreZ9sZ9uS5CsE79uHKuFniIyrvx1PeXgK/xMtgjlkDs8E9HC3O57zBc/bGPNN3NkRZ2Mh7cj+M4hrZX1HRHcilNgH0xKwB6o68rrJJl0e0var9ymboU8lmDiRBY4JM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780575264; c=relaxed/simple; bh=Bkx11sUNszdwIHhq4gBPkGpD8tN3++Eftz5dCfj0OOE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QFcNJr31JKzfHYCh1EOm+EK0HHZ98zXQsb6XzTXOzd579qCKonxRgAih7MRYCT9ukRyFhoBYABcm5XuypFpdVVouErBODaUeMHCuLwEckmdC3ecuEGoCy6xuzE/FhHkeOupEvFOqiCdxVvN7rVbtnydeJXAAvThSlgsQj86Vuvc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=L1Qpxb+9; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="L1Qpxb+9" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-36b8e1760ccso362208a91.0 for ; Thu, 04 Jun 2026 05:14:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780575263; x=1781180063; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=oyxRxCYOdMyc8Dc3ZoAGzmBA02Un7oBiGn+qmKX5HP8=; b=L1Qpxb+9sI+/c2lErmEQbMZAr6Gc3KvexxVD8sZfZe1QRshdASSV7SXL3aY8FzhNeL Ik8VwesFaB3F/9304OOkrofVKs5nBFDSybsRSz1EWUmcvrBt66yXHcjlGzwNACQkl1vR 5b9iFQJCpqnMyEUmsYY4ucYgrZriuMY7Ky/UfQ6vgSr/ATICDPbQurqi7sBDuo4JnXu5 yA6ndC6UgmXmsvCLQPVjN6JBMpN9OIp01+CWjcBtqUQFKf6vBEPu0Y4KZvrqa6FXFOEg Q5qraxlkiDpzUUkzS+OqKW/LnZenoLiAhGAoUwYwnrV3O4/Yf0GFlaV8MK0DJQLIdzf2 4N4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780575263; x=1781180063; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=oyxRxCYOdMyc8Dc3ZoAGzmBA02Un7oBiGn+qmKX5HP8=; b=iPhIkzYkW0TExztYMuFKBYxPdA5t1xOq6OJOwQp5NadZ423VHqKV0+bMnRzxGfxXaU NQoHQOV/nI4A5NxIUzQNYuIzwO75/s3cFVNHwCZuuOixewmg3rCrKbJjeNN/OwC4b9nu Rm+zR7xZSchmWn9RaNtOi38a2pVGyVegRtiuAUfBkA2guVmb8nZ+n1HzqBzUPeAGAHxc 39u5QEsEXIwhi9qqMhxGc/0Y+C5XuMX9+mmBO3I1BV/xOhOHTn6063urDBdsBPOLKct4 X1nnrZyxSjQEpBDDo94LlMngZFKmMGnWRsD4Hx0KSsUPDs+LpVYAAMFbK7qSzuV02ae2 ajzA== X-Forwarded-Encrypted: i=1; AFNElJ+j0DIybuTYU6ME4QYpoTSWzFRzxjgzl4+So3YwEtzdr9vrIqh7T2A34WLI1S5AOBdP0fLVB+E3Gw0Y1Kg=@vger.kernel.org X-Gm-Message-State: AOJu0Yz2D6PlQjfXzBpQTxN9BHYcbUvxH1AIe6Q7CLRIdjzKQHKLuhTH 9WhTqyn8FQYHjVOmD8qoYm+9Dj/yRXTXP3k0cuEm/snvzrbE0nQiPQSz X-Gm-Gg: Acq92OHVNkU9ep6cZs3G8p2TQ/edkZ2r/31bL/f7ZP+F55InANPSLami2916UKuQG8z A1ZBFFWn3oazjc97G5AbHt9RqC2YyZbnbu3p1v4uIQgxhQNGkm/g09H709USBuqKQOd/IE7wAv4 fEFtsnTjIHe9rAiOZJ3PSLGJOzuh1qwOUHN/fKXT1xPt9VEnmOMpe/AwQTDIZissmO/XwCc4wfX 8mhEW3H2rPhwYHVzBJAIAdOWevxh+QsTCEDKeqooQvRmDUTVrONu3rO2E3dVHmvpLJmSEMIfeEk iWVuSQMaXmHWcJ92kota+6tBu9Qq9Lxft+VbNHx2Fnlrr7KcUxCJ8KFtdj1DBPAlwALM4rI6cOM zbjJItYS0YJZ2O2y/57HUuL1ToijkF2WeN3eU2kEVEumhGTpvCNB3f7b/8U3b+xz8PVfKD8sCpK MhyYkGJr283HjMHtyD X-Received: by 2002:a17:90a:b401:b0:36b:5b82:4834 with SMTP id 98e67ed59e1d1-36e30c213bfmr5045300a91.7.1780575262731; Thu, 04 Jun 2026 05:14:22 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36f6c675898sm3071384a91.6.2026.06.04.05.14.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Jun 2026 05:14:21 -0700 (PDT) From: Guangshuo Li To: Chris Mason , David Sterba , Naohiro Aota , Johannes Thumshirn , linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] btrfs: fix zoned sub_group leak on space_info sysfs failure Date: Thu, 4 Jun 2026 20:10:43 +0800 Message-ID: <20260604121043.1425201-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On zoned filesystems, create_space_info() creates a space_info sub_group before registering the parent space_info in sysfs. If the sub_group registration succeeds but the parent btrfs_sysfs_add_space_info_type() call fails, the parent space_info is released through its kobject release path, but the already published sub_group is left behind. The sub_group also keeps its logical parent pointer, which then points at freed memory. Remember the created sub_group before registering the parent and remove it when parent sysfs registration fails. Cache the sub_group pointer before calling btrfs_sysfs_add_space_info_type(), as that helper may already have put and released the parent on failure. Fixes: f92ee31e031c7 ("btrfs: introduce btrfs_space_info sub-group") Signed-off-by: Guangshuo Li --- fs/btrfs/space-info.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c index f0436eea1544..03659dfcb830 100644 --- a/fs/btrfs/space-info.c +++ b/fs/btrfs/space-info.c @@ -296,6 +296,7 @@ static int create_space_info(struct btrfs_fs_info *info= , u64 flags) { =20 struct btrfs_space_info *space_info; + struct btrfs_space_info *sub_group =3D NULL; int ret =3D 0; =20 space_info =3D kzalloc_obj(*space_info, GFP_NOFS); @@ -316,11 +317,15 @@ static int create_space_info(struct btrfs_fs_info *in= fo, u64 flags) =20 if (ret) goto out_free; + sub_group =3D space_info->sub_group[0]; } =20 ret =3D btrfs_sysfs_add_space_info_type(space_info); - if (ret) + if (ret) { + if (sub_group) + btrfs_sysfs_remove_space_info(sub_group); return ret; + } =20 list_add(&space_info->list, &info->space_info); if (flags & BTRFS_BLOCK_GROUP_DATA) --=20 2.43.0