On Mon, Apr 20, 2020 at 01:38:40PM +0800, Xiyu Yang wrote: > btrfs_remove_block_group() invokes btrfs_lookup_block_group(), which > returns a local reference of the blcok group that contains the given > bytenr to "block_group" with increased refcount. > > When btrfs_remove_block_group() returns, "block_group" becomes invalid, > so the refcount should be decreased to keep refcount balanced. > > The reference counting issue happens in several exception handling paths > of btrfs_remove_block_group(). When those error scenarios occur such as > btrfs_alloc_path() returns NULL, the function forgets to decrease its > refcnt increased by btrfs_lookup_block_group() and will cause a refcnt > leak. > > Fix this issue by jumping to "out_put_group" label and calling > btrfs_put_block_group() when those error scenarios occur. > > Signed-off-by: Xiyu Yang <xiyuyang19@xxxxxxxxxxxx> > Signed-off-by: Xin Tan <tanxin.ctf@xxxxxxxxx> Thanks for the fix. May I ask if this was found by code inspection or by some analysis tool? > @@ -1132,6 +1132,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, > btrfs_delayed_refs_rsv_release(fs_info, 1); > btrfs_free_path(path); > return ret; > +out_put_group: > + btrfs_put_block_group(block_group); > + goto out; As Filipe noted, the trailing gotos are not a great pattern, what we'd like to do is a more linear sequence where the resource allocation/freeing nesting is obvious, like: x = allocate(X); if (!x) goto out; ... y = allocate(Y); if (!y) goto out_free_x; z = allocate(Z); if (!z) goto out_free_y; ... free(z); out_free_y: free(y); out_free_x: free(x); out: return; (where allocate/free can be refcount inc/dec and similar). Sometimes it's not that straightforward and the freeing block needs conditionals, but from code reading perspective this is still better than potentially wild gotos.
