[PATCH] hfsplus: Supports freeing newly created tree head
From: Edward Adam Davis
Date: Sat Apr 18 2026 - 05:38:03 EST
On Fri, 17 Apr 2026 15:03:17 -0700, Viacheslav Dubeyko wrote:
> > hfs_bnode_put() does not support deallocating a newly created btree
> > head node; therefore, regardless of whether hfsplus_bnode_find() succeeds
> > or fails, it cannot effectively reclaim the memory allocated for a newly
> > created head node.
> >
> > When finding a head node, if the node is a newly created one, we can use
> > hfs_bnode_free() to reclaim its memory.
> >
> > [1]
> > BUG: memory leak
> > unreferenced object 0xffff88811cabc840 (size 96):
> > backtrace (crc 3e2dadb7):
> > __hfs_bnode_create+0x59/0x310 fs/hfsplus/bnode.c:469
> > hfsplus_bnode_find+0x13e/0x580 fs/hfsplus/bnode.c:547
> > hfsplus_btree_open+0x2fa/0x6d0 fs/hfsplus/btree.c:382
> > hfsplus_fill_super+0x272/0x880 fs/hfsplus/super.c:548
>
> I need slightly more detailed and clear explanation how the issue has been
> happened and why we need to fix it in a such way. Currently, I don't have the
> complete picture how this happened. I am sure that you have the complete
> picture. :) Could you please share what you have in your mind? :) Don't hide the
> wisdom. ;)
fc_mount()
vfs_get_tree()
get_tree_bdev_flags()
hfsplus_fill_super()
hfsplus_btree_open()
hfsplus_bnode_find(tree, HFSPLUS_TREE_HEAD)
__hfs_bnode_create()
...
node->this = cnid; // cnid is HFSPLUS_TREE_HEAD, it is 0
...
...
desc = (struct hfs_bnode_desc *)(kmap_local_page(node->page[0])
node->type = desc->type;
switch (node->type) {
...
default: // because node->type is 127, so run here
goto node_error;
...
hfs_bnode_put()
...
if (test_bit(HFS_BNODE_DELETED, &node->flags)) { /* head node not set HFS_BNODE_DELETED flag
* so, the node will never be freed.
* Furthermore, even if the node were marked
* with the HFS_BNODE_DELETED flag, hfs_bmap_free()
* would still trigger BUG_ON(!node->this).
*/
Edward
BR