[PATCH] xfs: fix memory leak in xfs_dqinode_metadir_create()

[PATCH] xfs: fix memory leak in xfs_dqinode_metadir_create()

[Dawei Feng]

If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current
code returns directly, leaking the allocated update and transaction state.
If the subsequent commit fails, the caller-owned inode reference is left
behind.

Fix this memory leak by routing the create failure path through
xfs_metadir_cancel().  For both create and commit failures, finish and
release any inode returned to the caller, mirroring the unwind pattern in
xfs_metadir_mkdir().

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. Runtime validation
used kprobe fault injection during `mount -o uquota` on a metadir XFS
image. Injecting xfs_metadir_create() reproduced the old active-update path
that left mount stuck later in mount setup; after this change, the same
injection reported cancel_hits=1 and irele_hits=1. Injecting
xfs_metadir_commit() exercised the old inode-reference leak path; after
this change, it reported irele_hits=1.

Fixes: e80fbe1ad8ef ("xfs: use metadir for quota inodes")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
 fs/xfs/libxfs/xfs_dquot_buf.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
index ce767b40482f..bbada0d3cc08 100644
--- a/fs/xfs/libxfs/xfs_dquot_buf.c
+++ b/fs/xfs/libxfs/xfs_dquot_buf.c
@@ -436,17 +436,27 @@ xfs_dqinode_metadir_create(
 
 	error = xfs_metadir_create(&upd, S_IFREG);
 	if (error)
-		return error;
+		goto out_cancel;
 
 	xfs_trans_log_inode(upd.tp, upd.ip, XFS_ILOG_CORE);
 
 	error = xfs_metadir_commit(&upd);
 	if (error)
-		return error;
+		goto out_irele;
 
 	xfs_finish_inode_setup(upd.ip);
 	*ipp = upd.ip;
 	return 0;
+
+out_cancel:
+	xfs_metadir_cancel(&upd, error);
+out_irele:
+	/* Have to finish setting up the inode to ensure it's deleted. */
+	if (upd.ip) {
+		xfs_finish_inode_setup(upd.ip);
+		xfs_irele(upd.ip);
+	}
+	return error;
 }
 
 #ifndef __KERNEL__
-- 
2.34.1

Re: [PATCH] xfs: fix memory leak in xfs_dqinode_metadir_create()

[Darrick J. Wong]

On Sat, Jun 27, 2026 at 02:04:02PM +0800, Dawei Feng wrote:
> If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current
> code returns directly, leaking the allocated update and transaction state.
> If the subsequent commit fails, the caller-owned inode reference is left
> behind.
> 
> Fix this memory leak by routing the create failure path through
> xfs_metadir_cancel().  For both create and commit failures, finish and
> release any inode returned to the caller, mirroring the unwind pattern in
> xfs_metadir_mkdir().
> 
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1.1.
> 
> An x86_64 allyesconfig build showed no new warnings. Runtime validation
> used kprobe fault injection during `mount -o uquota` on a metadir XFS
> image. Injecting xfs_metadir_create() reproduced the old active-update path
> that left mount stuck later in mount setup; after this change, the same
> injection reported cancel_hits=1 and irele_hits=1. Injecting
> xfs_metadir_commit() exercised the old inode-reference leak path; after
> this change, it reported irele_hits=1.
> 
> Fixes: e80fbe1ad8ef ("xfs: use metadir for quota inodes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>

Heh, I have a patch just like this one in my tree courtesy of codex,
so I think this is fair:

Cc: <stable@vger.kernel.org> # v6.13
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

> ---
>  fs/xfs/libxfs/xfs_dquot_buf.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
> index ce767b40482f..bbada0d3cc08 100644
> --- a/fs/xfs/libxfs/xfs_dquot_buf.c
> +++ b/fs/xfs/libxfs/xfs_dquot_buf.c
> @@ -436,17 +436,27 @@ xfs_dqinode_metadir_create(
>  
>  	error = xfs_metadir_create(&upd, S_IFREG);
>  	if (error)
> -		return error;
> +		goto out_cancel;
>  
>  	xfs_trans_log_inode(upd.tp, upd.ip, XFS_ILOG_CORE);
>  
>  	error = xfs_metadir_commit(&upd);
>  	if (error)
> -		return error;
> +		goto out_irele;
>  
>  	xfs_finish_inode_setup(upd.ip);
>  	*ipp = upd.ip;
>  	return 0;
> +
> +out_cancel:
> +	xfs_metadir_cancel(&upd, error);
> +out_irele:
> +	/* Have to finish setting up the inode to ensure it's deleted. */
> +	if (upd.ip) {
> +		xfs_finish_inode_setup(upd.ip);
> +		xfs_irele(upd.ip);
> +	}
> +	return error;
>  }
>  
>  #ifndef __KERNEL__
> -- 
> 2.34.1
> 
> 

Re: [PATCH] xfs: fix memory leak in xfs_dqinode_metadir_create()

[Carlos Maiolino]

On Sat, 27 Jun 2026 14:04:02 +0800, Dawei Feng wrote:
> If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current
> code returns directly, leaking the allocated update and transaction state.
> If the subsequent commit fails, the caller-owned inode reference is left
> behind.
> 
> Fix this memory leak by routing the create failure path through
> xfs_metadir_cancel().  For both create and commit failures, finish and
> release any inode returned to the caller, mirroring the unwind pattern in
> xfs_metadir_mkdir().
> 
> [...]

Applied to for-next, thanks!

[1/1] xfs: fix memory leak in xfs_dqinode_metadir_create()
      commit: 45de375b25060edf46e20abb36521ba530336ceb

Best regards,
-- 
Carlos Maiolino <cem@kernel.org>