On Tue, Jun 16, 2026 at 04:08:17PM +0200, Christian Brauner wrote: > Since the rt and log block devices are closed in xfs_free_buftarg() the > buftarg owns the device file. The error unwind does not respect that: > when the log buftarg allocation fails, out_free_rtdev_targ frees the rt > buftarg - releasing rtdev_file - and then falls through to > out_close_rtdev and releases it a second time. > > The unwind also leaves mp->m_rtdev_targp and mp->m_ddev_targp pointing > to the freed buftargs. The failed mount continues into > deactivate_locked_super() -> xfs_kill_sb() -> xfs_mount_free(), which > frees them again. > > Clear the buftarg pointers once the unwind freed them and clear > rtdev_file once the rt buftarg owns it, so nothing is released twice. > > Reachable when a buftarg allocation fails after the data buftarg was > set up: an I/O error in sync_blockdev() or an allocation failure in > xfs_init_buftarg() while mounting with external rt and log devices.
Looks good: Reviewed-by: Christoph Hellwig <[email protected]> I actually have a major rework of this area pending, but it probably won't land for 7.2, so we might as well get this local fix in ASAP.
