[PATCH v2 0/3] btrfs: fix failed sprout device add rollback

[PATCH v2 0/3] btrfs: fix failed sprout device add rollback

[Guanghui Yang]

Hi,

This series fixes the error path for adding the first writable device to a
seed filesystem.

I verified the failure path locally in QEMU with null_blk and a seed btrfs
filesystem:

- create btrfs on /dev/nullb0
- set the seed flag with btrfstune -S 1
- mount the filesystem read-only
- run "btrfs device add -f /dev/nullb1 /mnt"
- inject -EIO after metadata chunk creation in init_first_rw_device()

Before these fixes, the injected failure triggered:

- WARN_ON(!list_empty(&device->post_commit_list)) in btrfs_free_device()
- a NULL pointer dereference through btrfs_show_devname()
- the sprout fs_devices state left with no open devices

Without the injected failure, the same device-add path succeeds.

Guanghui Yang (3):
  btrfs: detach failed sprout device from transaction update list
  btrfs: restore active device pointers after failed sprout
  btrfs: roll back sprout setup after device add failure

This v2 keeps the code changes unchanged and adds the local reproduction
result to the cover letter.

 fs/btrfs/volumes.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)


base-commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557
-- 
2.53.0

Re: [PATCH v2 0/3] btrfs: fix failed sprout device add rollback

[Qu Wenruo]

在 2026/8/10 20:29, Guanghui Yang 写道:
> Hi,
> 
> This series fixes the error path for adding the first writable device to a
> seed filesystem.
> 
> I verified the failure path locally in QEMU with null_blk and a seed btrfs
> filesystem:
> 
> - create btrfs on /dev/nullb0
> - set the seed flag with btrfstune -S 1
> - mount the filesystem read-only
> - run "btrfs device add -f /dev/nullb1 /mnt"
> - inject -EIO after metadata chunk creation in init_first_rw_device()
> 
> Before these fixes, the injected failure triggered:
> 
> - WARN_ON(!list_empty(&device->post_commit_list)) in btrfs_free_device()
> - a NULL pointer dereference through btrfs_show_devname()
> - the sprout fs_devices state left with no open devices
> 
> Without the injected failure, the same device-add path succeeds.

Missing AI disclosure?

> 
> Guanghui Yang (3):
>    btrfs: detach failed sprout device from transaction update list
>    btrfs: restore active device pointers after failed sprout
>    btrfs: roll back sprout setup after device add failure
> 
> This v2 keeps the code changes unchanged and adds the local reproduction
> result to the cover letter.
> 
>   fs/btrfs/volumes.c | 43 +++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 43 insertions(+)
> 
> 
> base-commit: 38fec10eb60d687e30c8c6b5420d86e8149f7557