linux-kernel - Forwarded: [PATCH] btrfs: qgroup: fix memory leak when add_qgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <693b622a.a70a0220.33cd7b.003d.GAE@google.com>
Date: Thu, 11 Dec 2025 16:30:34 -0800
From: syzbot <syzbot+803e4cb8245b52928347@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] btrfs: qgroup: fix memory leak when
 add_qgroup_item() fails

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] btrfs: qgroup: fix memory leak when add_qgroup_item() fails
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

If add_qgroup_item() fails, we jump to the out label without freeing the
preallocated qgroup structure. This causes a memory leak and triggers
the ASSERT(prealloc == NULL) assertion.

Fix this by freeing prealloc and setting it to NULL before jumping to
the out label when add_qgroup_item() fails.

Reported-by: syzbot+803e4cb8245b52928347@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=803e4cb8245b52928347
Fixes: 8d54518b5e52 ("btrfs: qgroup: pre-allocate btrfs_qgroup to reduce GFP_ATOMIC usage")
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 fs/btrfs/qgroup.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e2b53e90dcb..4dbf6d2d2aaa 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1671,8 +1671,11 @@ int btrfs_create_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid)
 	}
 
 	ret = add_qgroup_item(trans, quota_root, qgroupid);
-	if (ret)
+	if (ret) {
+		kfree(prealloc);
+		prealloc = NULL;
 		goto out;
+	}
 
 	spin_lock(&fs_info->qgroup_lock);
 	qgroup = add_qgroup_rb(fs_info, prealloc, qgroupid);
-- 
2.43.0