Filipe Manana @ 2026-02-17 11:10 GMT:

> On Mon, Feb 16, 2026 at 9:13 PM Miquel Sabaté Solà <mssola@mssola.com> wrote:
>>
>
> As for the subject, should be instead:
>
> btrfs: free pages on error in btrfs_read_uring_extent()
>
> Note we don't usually surround function names with quotes and we
> usually add the () after their name.
>
>> In this function the 'pages' object is never freed in the hopes that is
>
> that is -> that it is
>
>> picked up by btrfs_uring_read_finished() whenever that executes in the
>> future. But that's just the happy path. Along the way previous
>> allocations might have gone wrong, or we might not get -EIOCBQUEUED from
>> btrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a
>> cleanup section that frees all memory allocated by this function without
>> assuming any deferred execution, and this also needs to happen for the
>> 'pages' allocation.
>>
>> Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
>
> Not contrary to what you had just suggested for a cleanup patch here:
> https://lore.kernel.org/linux-btrfs/87tsvfu11i.fsf@/
>
> This is the sort of change that should have a Fixes tag, because it
> fixes a bug, something that affects users, therefore useful and
> important to have backported to stable releases.
>
> So adding a:
>
> Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads
> (ENCODED_READ ioctl)")
>
> You don't need to do any of these changes, I've done that changes
> myself and added it to the github for-next branch, thanks.
>
> Reviewed-by: Filipe Manana <fdmanana@suse.com>
>
>

You are totally right, completely missed that one.

Thanks!
Miquel

>> ---
>>  fs/btrfs/ioctl.c | 7 ++++++-
>>  1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
>> index 38d93dae71ca..b3e8a8d9b19d 100644
>> --- a/fs/btrfs/ioctl.c
>> +++ b/fs/btrfs/ioctl.c
>> @@ -4651,7 +4651,7 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
>>  {
>>         struct btrfs_inode *inode = BTRFS_I(file_inode(iocb->ki_filp));
>>         struct extent_io_tree *io_tree = &inode->io_tree;
>> -       struct page **pages;
>> +       struct page **pages = NULL;
>>         struct btrfs_uring_priv *priv = NULL;
>>         unsigned long nr_pages;
>>         int ret;
>> @@ -4709,6 +4709,11 @@ static int btrfs_uring_read_extent(struct kiocb *iocb, struct iov_iter *iter,
>>         btrfs_unlock_extent(io_tree, start, lockend, &cached_state);
>>         btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
>>         kfree(priv);
>> +       for (int i = 0; i < nr_pages; i++) {
>> +               if (pages[i])
>> +                       __free_page(pages[i]);
>> +       }
>> +       kfree(pages);
>>         return ret;
>>  }
>>
>> --
>> 2.53.0
>>
>>