When the fs root read back for a reloc root does not have the expected
reloc_root backref, merge_reloc_roots() warns, sets ret = -EINVAL and
jumps to out without dropping the reference returned by
btrfs_get_fs_root(), leaking it on this error path.

Drop the reference before jumping to out, matching what
merge_reloc_root() already does for the same mismatch condition.

Fixes: 05d7ce504545 ("btrfs: exit gracefully if reloc roots don't match")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 fs/btrfs/relocation.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 3ebaf5880125..6c826be41749 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1850,6 +1850,7 @@ void merge_reloc_roots(struct reloc_control *rc)
 				 * corruption, e.g. bad reloc tree key offset.
 				 */
 				ret = -EINVAL;
+				btrfs_put_root(root);
 				goto out;
 			}
 			ret = merge_reloc_root(rc, root);
-- 
2.34.1

On Wed, Sep 16, 2026 at 6:26 PM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> When the fs root read back for a reloc root does not have the expected
> reloc_root backref, merge_reloc_roots() warns, sets ret = -EINVAL and
> jumps to out without dropping the reference returned by
> btrfs_get_fs_root(), leaking it on this error path.
>
> Drop the reference before jumping to out, matching what
> merge_reloc_root() already does for the same mismatch condition.
>
> Fixes: 05d7ce504545 ("btrfs: exit gracefully if reloc roots don't match")

What tree are you using? This was already fixed in 7.2:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce6050bafb4e33377dc17fcc357736bfc351180c

The Fixes tag is also wrong, it's the one mentioned in that commit.

Thanks.

> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  fs/btrfs/relocation.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index 3ebaf5880125..6c826be41749 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -1850,6 +1850,7 @@ void merge_reloc_roots(struct reloc_control *rc)
>                                  * corruption, e.g. bad reloc tree key offset.
>                                  */
>                                 ret = -EINVAL;
> +                               btrfs_put_root(root);
>                                 goto out;
>                         }
>                         ret = merge_reloc_root(rc, root);
> --
> 2.34.1
>
>