| From e534053528ec26f026e86bf63800695e5c3ad748 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 11 Dec 2025 11:51:19 +0000 |
| Subject: btrfs: fix changeset leak on mmap write after failure to reserve |
| metadata |
| |
| From: Filipe Manana <fdmanana@suse.com> |
| |
| [ Upstream commit 37343524f000d2a64359867d7024a73233d3b438 ] |
| |
| If the call to btrfs_delalloc_reserve_metadata() fails we jump to the |
| 'out_noreserve' label and there we never free the extent_changeset |
| allocated by the previous call to btrfs_check_data_free_space() (if |
| qgroups are enabled). Fix this by calling extent_changeset_free() under |
| the 'out_noreserve' label. |
| |
| Fixes: 6599716de2d6 ("btrfs: fix -ENOSPC mmap write failure on NOCOW files/extents") |
| Reported-by: syzbot+2f8aa76e6acc9fce6638@syzkaller.appspotmail.com |
| Link: https://lore.kernel.org/linux-btrfs/693a635a.a70a0220.33cd7b.0029.GAE@google.com/ |
| Reviewed-by: Qu Wenruo <wqu@suse.com> |
| Signed-off-by: Filipe Manana <fdmanana@suse.com> |
| Reviewed-by: David Sterba <dsterba@suse.com> |
| Signed-off-by: David Sterba <dsterba@suse.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/btrfs/file.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c |
| index fa82def46e395..0fee45d35a5f8 100644 |
| --- a/fs/btrfs/file.c |
| +++ b/fs/btrfs/file.c |
| @@ -2018,13 +2018,14 @@ static vm_fault_t btrfs_page_mkwrite(struct vm_fault *vmf) |
| else |
| btrfs_delalloc_release_space(inode, data_reserved, page_start, |
| reserved_space, true); |
| - extent_changeset_free(data_reserved); |
| out_noreserve: |
| if (only_release_metadata) |
| btrfs_check_nocow_unlock(inode); |
| |
| sb_end_pagefault(inode->vfs_inode.i_sb); |
| |
| + extent_changeset_free(data_reserved); |
| + |
| if (ret < 0) |
| return vmf_error(ret); |
| |
| -- |
| 2.51.0 |
| |
