diff options
| author | Guangshuo Li <lgs201920130244@gmail.com> | 2026-04-01 13:56:19 +0300 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2026-04-07 19:56:09 +0300 |
| commit | 3f487be81292702a59ea9dbc4088b3360a50e837 (patch) | |
| tree | e1fdbce05c5399660922caa8e12abdbc9c864ecd | |
| parent | a7449edf96143f192606ec8647e3167e1ecbd728 (diff) | |
| download | linux-3f487be81292702a59ea9dbc4088b3360a50e837.tar.xz | |
btrfs: fix double free in create_space_info() error path
When kobject_init_and_add() fails, the call chain is:
create_space_info()
-> btrfs_sysfs_add_space_info_type()
-> kobject_init_and_add()
-> failure
-> kobject_put(&space_info->kobj)
-> space_info_release()
-> kfree(space_info)
Then control returns to create_space_info():
btrfs_sysfs_add_space_info_type() returns error
-> goto out_free
-> kfree(space_info)
This causes a double free.
Keep the direct kfree(space_info) for the earlier failure path, but
after btrfs_sysfs_add_space_info_type() has called kobject_put(), let
the kobject release callback handle the cleanup.
Fixes: a11224a016d6d ("btrfs: fix memory leaks in create_space_info() error paths")
CC: stable@vger.kernel.org # 6.19+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | fs/btrfs/space-info.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c index 8278e7998bc9..f0436eea1544 100644 --- a/fs/btrfs/space-info.c +++ b/fs/btrfs/space-info.c @@ -320,7 +320,7 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags) ret = btrfs_sysfs_add_space_info_type(space_info); if (ret) - goto out_free; + return ret; list_add(&space_info->list, &info->space_info); if (flags & BTRFS_BLOCK_GROUP_DATA) |