btrfs_dev_replace_start() adds the replacement target to the device
list before marking block groups to copy. If marking fails, returning
directly leaves the target linked and keeps the device accounting
incremented.

Jump to the existing cleanup path so the target device is removed and
released on failure.

The issue was found by a failure-path metadata residual analyzer and
verified with targeted failure injection on v6.14.

Assisted-by: Codex:gpt-5
Signed-off-by: Guanghui Yang <3497809730@qq.com>
---
 fs/btrfs/dev-replace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 318ddb790..bf0b78790 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -626,7 +626,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
 
 	ret = mark_block_group_to_copy(fs_info, src_device);
 	if (ret)
-		return ret;
+		goto leave;
 
 	down_write(&dev_replace->rwsem);
 	dev_replace->replace_task = current;
-- 
2.53.0

在 2026/8/8 16:08, Guanghui Yang 写道:
> btrfs_dev_replace_start() adds the replacement target to the device
> list before marking block groups to copy. If marking fails, returning
> directly leaves the target linked and keeps the device accounting
> incremented.
> 
> Jump to the existing cleanup path so the target device is removed and
> released on failure.
> 
> The issue was found by a failure-path metadata residual analyzer and
> verified with targeted failure injection on v6.14.
> 
> Assisted-by: Codex:gpt-5
> Signed-off-by: Guanghui Yang <3497809730@qq.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

Pushed into for-next branch.

> ---
>   fs/btrfs/dev-replace.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
> index 318ddb790..bf0b78790 100644
> --- a/fs/btrfs/dev-replace.c
> +++ b/fs/btrfs/dev-replace.c
> @@ -626,7 +626,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
>   
>   	ret = mark_block_group_to_copy(fs_info, src_device);
>   	if (ret)
> -		return ret;
> +		goto leave;
>   
>   	down_write(&dev_replace->rwsem);
>   	dev_replace->replace_task = current;