[lvc-project] [PATCH 6.12] btrfs: free path if inline extents in range_is_hole_in_parent()

[Mikhail Dmitrichenko]

Commit db00636643e6 ("btrfs: send: check for inline extents in
range_is_hole_in_parent()") is a patch backported directly from
mainline to 6.12, it does not free the path in the inline extents case.

The original patch in mainline does not have this problem because
commit 4ca6f24a52c4 ("btrfs: more trivial BTRFS_PATH_AUTO_FREE
conversions") in 6.18-rc1 converted range_is_hole_in_parent() to
scope-based auto-cleanup. 6.12 already provides BTRFS_PATH_AUTO_FREE,
but range_is_hole_in_parent() still frees the path manually at the out
label, so use a goto there to avoid the memory leak in the inline
extents case.

Fixes: db00636643e6 ("btrfs: send: check for inline extents in range_is_hole_in_parent()")
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko at astralinux.ru>
---
This is a follow-up fix for the 6.12.y backport of the CVE-2026-23141 fix.
The same change for 6.6.y was posted by Hongbo Li and reviewed by
Qu Wenruo there:
https://lore.kernel.org/all/20260227075219.2594937-1-lihongbo22@huawei.com/

 fs/btrfs/send.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 6300418ce357..c9618340f09b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6549,8 +6549,10 @@ static int range_is_hole_in_parent(struct send_ctx *sctx,
 		extent_end = btrfs_file_extent_end(path);
 		if (extent_end <= start)
 			goto next;
-		if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)
-			return 0;
+		if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) {
+			ret = 0;
+			goto out;
+		}
 		if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) {
 			search_start = extent_end;
 			goto next;
-- 
2.43.0