btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
authorFilipe Manana <fdmanana@suse.com>
Tue, 1 Nov 2022 16:15:37 +0000 (16:15 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Nov 2022 17:15:29 +0000 (18:15 +0100)
commit6ba3479f9e96b9ad460c7e77abc26dd16e5dec4f
tree514c94cb63a5e4add524486ab548950fc29b20f9
parenta80634f392af8c42a5a9d2b3822acc6e7795c8be
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()

[ Upstream commit 5614dc3a47e3310fbc77ea3b67eaadd1c6417bf1 ]

During backref walking, at resolve_indirect_refs(), if we get an error
we jump to the 'out' label and call ulist_free() on the 'parents' ulist,
which frees all the elements in the ulist - however that does not free
any inode lists that may be attached to elements, through the 'aux' field
of a ulist node, so we end up leaking lists if we have any attached to
the unodes.

Fix this by calling free_leaf_list() instead of ulist_free() when we exit
from resolve_indirect_refs(). The static function free_leaf_list() is
moved up for this to be possible and it's slightly simplified by removing
unnecessary code.

Fixes: 3301958b7c1d ("Btrfs: add inodes before dropping the extent lock in find_all_leafs")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/btrfs/backref.c