On Tue, Nov 4, 2025 at 1:21 PM Zhen Ni zhen.ni@easystack.cn wrote:

When check_next_block_uptodate() fails, do_walk_down() returns directly without cleaning up the locked extent buffer allocated earlier, causing memory and lock leaks.

Fix by using the existing out_unlock cleanup path instead of direct return.

Fixes: 562d425454e8 ("btrfs: factor out eb uptodate check from do_walk_down()") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni zhen.ni@easystack.cn

---

fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index dc4ca98c3780..742e476bf815 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5770,7 +5770,7 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,

    ret = check_next_block_uptodate(trans, root, path, wc, next);
    if (ret)

•           return ret;
  

•           goto out_unlock;
  

This is wrong and will cause a double unlock and double free.

When check_next_block_uptodate() returns an error, it has already unlocked and freed the extent buffer.

Thanks.

    level--;
    ASSERT(level == btrfs_header_level(next));

-- 2.20.1