From: Filipe Manana <fdman...@suse.com> commit 72c9925f87c8b74f36f8e75a4cd93d964538d3ca upstream.
At btrfs_copy_root(), if the call to btrfs_inc_ref() fails we end up returning without unlocking and releasing our reference on the extent buffer named "cow" we previously allocated with btrfs_alloc_tree_block(). So fix that by unlocking the extent buffer and dropping our reference on it before returning. Fixes: be20aa9dbadc8c ("Btrfs: Add mount option to turn off data cow") CC: sta...@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana <fdman...@suse.com> Reviewed-by: David Sterba <dste...@suse.com> Signed-off-by: David Sterba <dste...@suse.com> Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- fs/btrfs/ctree.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -283,6 +283,8 @@ int btrfs_copy_root(struct btrfs_trans_h else ret = btrfs_inc_ref(trans, root, cow, 0); if (ret) { + btrfs_tree_unlock(cow); + free_extent_buffer(cow); btrfs_abort_transaction(trans, ret); return ret; }