__add_reloc_root() allocates a mapping_node before inserting it into
rc->reloc_root_tree.  If rb_simple_insert() finds an existing entry, it
returns the existing rb_node and leaves the newly allocated node unlinked.

The error path then returns -EEXIST without freeing the new node.  Since
the node was never inserted into reloc_root_tree, the later cleanup in
put_reloc_control() cannot find it either.

Free the newly allocated node before returning -EEXIST.

The callers currently assert that -EEXIST should not happen, so this is a
defensive cleanup for an unexpected duplicate insert path.  If the path is
ever reached, the local allocation should still be released.

Fixes: 57a304cfd43b ("btrfs: do not panic in __add_reloc_root")
Signed-off-by: Guanghui Yang <3497809730@qq.com>
---
Changes in v2:
- Add Fixes tag as requested by Qu Wenruo.

 fs/btrfs/relocation.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index fb85bc8b345c..7e451e587726 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -588,6 +588,7 @@ static int __add_reloc_root(struct btrfs_root *root, struct reloc_control *rc)
 		btrfs_err(fs_info,
 			    "Duplicate root found for start=%llu while inserting into relocation tree",
 			    node->bytenr);
+		kfree(node);
 		return -EEXIST;
 	}
 
-- 
2.34.1

在 2026/7/12 12:47, Guanghui Yang 写道:
> __add_reloc_root() allocates a mapping_node before inserting it into
> rc->reloc_root_tree.  If rb_simple_insert() finds an existing entry, it
> returns the existing rb_node and leaves the newly allocated node unlinked.
> 
> The error path then returns -EEXIST without freeing the new node.  Since
> the node was never inserted into reloc_root_tree, the later cleanup in
> put_reloc_control() cannot find it either.
> 
> Free the newly allocated node before returning -EEXIST.
> 
> The callers currently assert that -EEXIST should not happen, so this is a
> defensive cleanup for an unexpected duplicate insert path.  If the path is
> ever reached, the local allocation should still be released.
> 
> Fixes: 57a304cfd43b ("btrfs: do not panic in __add_reloc_root")
> Signed-off-by: Guanghui Yang <3497809730@qq.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

> ---
> Changes in v2:
> - Add Fixes tag as requested by Qu Wenruo.
> 
>   fs/btrfs/relocation.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index fb85bc8b345c..7e451e587726 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -588,6 +588,7 @@ static int __add_reloc_root(struct btrfs_root *root, struct reloc_control *rc)
>   		btrfs_err(fs_info,
>   			    "Duplicate root found for start=%llu while inserting into relocation tree",
>   			    node->bytenr);
> +		kfree(node);
>   		return -EEXIST;
>   	}
>