When paths_from_inode() fails, scrub_print_warning_inode() jumps to
err without dropping the reference taken by btrfs_get_fs_root(),
leaking a reference to the root every time path resolution fails while
printing scrub warnings.  Every other error and success path of the
function drops the reference.

Drop the reference on the paths_from_inode() failure path too.

Fixes: 558540c17771 ("btrfs scrub: print paths of corrupted files")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 fs/btrfs/scrub.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 1ac609239cbe..570828ec780b 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -549,8 +549,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 num_bytes,
 	}
 	ret = paths_from_inode(inum, ipath);
 
-	if (ret < 0)
+	if (ret < 0) {
+		btrfs_put_root(local_root);
 		goto err;
+	}
 
 	/*
 	 * we deliberately ignore the bit ipath might have been too small to
-- 
2.34.1

On Wed, Sep 16, 2026 at 05:16:10PM +0000, Wentao Liang wrote:
> When paths_from_inode() fails, scrub_print_warning_inode() jumps to
> err without dropping the reference taken by btrfs_get_fs_root(),
> leaking a reference to the root every time path resolution fails while
> printing scrub warnings.  Every other error and success path of the
> function drops the reference.
> 
> Drop the reference on the paths_from_inode() failure path too.
> 
> Fixes: 558540c17771 ("btrfs scrub: print paths of corrupted files")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Added to for-next, thanks.

在 2026/9/17 02:46, Wentao Liang 写道:
> When paths_from_inode() fails, scrub_print_warning_inode() jumps to
> err without dropping the reference taken by btrfs_get_fs_root(),
> leaking a reference to the root every time path resolution fails while
> printing scrub warnings.  Every other error and success path of the
> function drops the reference.
> 
> Drop the reference on the paths_from_inode() failure path too.
> 
> Fixes: 558540c17771 ("btrfs scrub: print paths of corrupted files")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Qu Wenruo <wqu@suse.com>

Thanks,
Qu

> ---
>   fs/btrfs/scrub.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
> index 1ac609239cbe..570828ec780b 100644
> --- a/fs/btrfs/scrub.c
> +++ b/fs/btrfs/scrub.c
> @@ -549,8 +549,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 num_bytes,
>   	}
>   	ret = paths_from_inode(inum, ipath);
>   
> -	if (ret < 0)
> +	if (ret < 0) {
> +		btrfs_put_root(local_root);
>   		goto err;
> +	}
>   
>   	/*
>   	 * we deliberately ignore the bit ipath might have been too small to