This is a note to let you know that I've just added the patch titled btrfs: fixup error handling in fixup_inode_link_counts to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: btrfs-fixup-error-handling-in-fixup_inode_link_counts.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 011b28acf940eb61c000059dd9e2cfcbf52ed96b Mon Sep 17 00:00:00 2001 From: Josef Bacik <josef@xxxxxxxxxxxxxx> Date: Wed, 19 May 2021 13:13:15 -0400 Subject: btrfs: fixup error handling in fixup_inode_link_counts From: Josef Bacik <josef@xxxxxxxxxxxxxx> commit 011b28acf940eb61c000059dd9e2cfcbf52ed96b upstream. This function has the following pattern while (1) { ret = whatever(); if (ret) goto out; } ret = 0 out: return ret; However several places in this while loop we simply break; when there's a problem, thus clearing the return value, and in one case we do a return -EIO, and leak the memory for the path. Fix this by re-arranging the loop to deal with ret == 1 coming from btrfs_search_slot, and then simply delete the ret = 0; out: bit so everybody can break if there is an error, which will allow for proper error handling to occur. CC: stable@xxxxxxxxxxxxxxx # 4.4+ Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx> Reviewed-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/btrfs/tree-log.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1775,6 +1775,7 @@ static noinline int fixup_inode_link_cou break; if (ret == 1) { + ret = 0; if (path->slots[0] == 0) break; path->slots[0]--; @@ -1787,17 +1788,19 @@ static noinline int fixup_inode_link_cou ret = btrfs_del_item(trans, root, path); if (ret) - goto out; + break; btrfs_release_path(path); inode = read_one_inode(root, key.offset); - if (!inode) - return -EIO; + if (!inode) { + ret = -EIO; + break; + } ret = fixup_inode_link_count(trans, root, inode); iput(inode); if (ret) - goto out; + break; /* * fixup on a directory may create new entries, @@ -1806,8 +1809,6 @@ static noinline int fixup_inode_link_cou */ key.offset = (u64)-1; } - ret = 0; -out: btrfs_release_path(path); return ret; } Patches currently in stable-queue which might be from josef@xxxxxxxxxxxxxx are queue-5.4/btrfs-fixup-error-handling-in-fixup_inode_link_counts.patch queue-5.4/btrfs-tree-checker-do-not-error-out-if-extent-ref-ha.patch queue-5.4/btrfs-mark-ordered-extent-and-inode-with-error-if-we-fail-to-finish.patch queue-5.4/btrfs-fix-error-handling-in-btrfs_del_csums.patch queue-5.4/btrfs-return-errors-from-btrfs_del_csums-in-cleanup_ref_head.patch