Re: [PATCH] btrfs: fix double free in create_space_info() error path

[Qu Wenruo]

> So the call chain I had in mind is:
>
> `create_space_info()`
> -> `btrfs_sysfs_add_space_info_type()`
> -> `kobject_init_and_add()`
> -> failure
> -> `kobject_put(&space_info->kobj)`
> -> `space_info_release()`
> -> `kfree(space_info)`
>
> and then control returns to `create_space_info()`:
>
> `btrfs_sysfs_add_space_info_type()` returns error
> -> `goto out_free`
> -> `kfree(space_info)`

Please add those two parts into the changelog.

Otherwise the current one fix is good to me, for this particular call site.

> So my concern was that after `kobject_init_and_add()` has been called,
> the cleanup is already handed to `kobject_put()` /
> `space_info_release()`, and the later `kfree(space_info)` in
> `create_space_info()` becomes a second free.
>
> If my understanding of the `kobject_init_and_add()` failure path here
> is incorrect, please let me know. I may be missing something.

Furthermore, there is a similar bug in create_space_info_sub_group() and 
all other locations.

Personally speaking, I do not like the idea of releasing the space_info 
through the callback at all.

It breaks the common scheme where who allocates the memory should free 
it, now we have different handling before and after 
kobject_init_and_add(), which is causing all kinds of problems.

But I'm afraid that's the way we have to go.

Thanks,
Qu

> Thanks,
> Guangshuo
>
> Qu Wenruo <wqu@xxxxxxxx> 于2026年4月1日周三 12:34写道：
> > 在 2026/4/1 13:43, Guangshuo Li 写道:
> > > When kobject_init_and_add() fails, btrfs_sysfs_add_space_info_type()
> > > calls kobject_put(&space_info->kobj).
> > >
> > > The kobject release callback space_info_release() frees space_info,
> > > but the current error path in create_space_info() then calls
> > > kfree(space_info) again, causing a double free.
> >
> > Can you give an example call chain of where such space_info_release() is
> > triggered?
> >
> > > Keep the direct kfree(space_info) for the earlier failure path, but
> > > after btrfs_sysfs_add_space_info_type() has called kobject_put(), let
> > > the kobject release callback handle the cleanup.
> > >
> > > Fixes: a11224a016d6d ("btrfs: fix memory leaks in create_space_info() error paths")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > > ---
> > >    fs/btrfs/space-info.c | 2 +-
> > >    1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
> > > index 3f08e450f796..d7176eb2fcbf 100644
> > > --- a/fs/btrfs/space-info.c
> > > +++ b/fs/btrfs/space-info.c
> > > @@ -311,7 +311,7 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
> > >
> > >        ret = btrfs_sysfs_add_space_info_type(space_info);
> > >        if (ret)
> > > -             goto out_free;
> > > +             return ret;
> > >
> > >        list_add(&space_info->list, &info->space_info);
> > >        if (flags & BTRFS_BLOCK_GROUP_DATA)