Re: [PATCH] xfs: fix temporary cursor leak in btree shift corruption paths

[Carlos Maiolino]

On Mon, Nov 02, 2026 at 11:01:41PM +0800, jianyungao89@xxxxxxxxx wrote:
> From: Jianyun Gao <jianyungao89@xxxxxxxxx>
> 
> In xfs_btree_lshift and xfs_btree_rshift, when XFS_IS_CORRUPT detects
> an invalid firstrec/lastrec result after xfs_btree_dup_cursor has
> successfully allocated a temporary cursor, the error path jumps to
> error0 which returns without freeing tcur.  This leaks the cursor
> memory, the xfs_group reference, and the per-level buffer references
> held by the duplicated cursor.  Jump to error1 instead, which calls
> xfs_btree_del_cursor(tcur, XFS_BTREE_ERROR) to properly release all
> resources.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 9eaead51bed95 ("[XFS] implement generic xfs_btree_rshift")
> Signed-off-by: Jianyun Gao <jianyungao89@xxxxxxxxx>

Yup, that's leaking the duplicated cursor

Reviewed-by: Carlos Maiolino <cmaiolino@xxxxxxxxxx>

> ---
>  fs/xfs/libxfs/xfs_btree.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
> index 7effebe297ea..d706f59b0301 100644
> --- a/fs/xfs/libxfs/xfs_btree.c
> +++ b/fs/xfs/libxfs/xfs_btree.c
> @@ -2567,7 +2567,7 @@ xfs_btree_lshift(
>  		if (XFS_IS_CORRUPT(tcur->bc_mp, i != 1)) {
>  			xfs_btree_mark_sick(cur);
>  			error = -EFSCORRUPTED;
> -			goto error0;
> +			goto error1;
>  		}
>  
>  		error = xfs_btree_decrement(tcur, level, &i);
> @@ -2737,7 +2737,7 @@ xfs_btree_rshift(
>  	if (XFS_IS_CORRUPT(tcur->bc_mp, i != 1)) {
>  		xfs_btree_mark_sick(cur);
>  		error = -EFSCORRUPTED;
> -		goto error0;
> +		goto error1;
>  	}
>  
>  	error = xfs_btree_increment(tcur, level, &i);
> -- 
> 2.34.1
>