btrfs_dev_replace_start() opens the replacement target with btrfs_init_dev_replace_tgtdev(), which adds it to the device list and opens its block device. Every error path after that point reaches the 'leave' label to tear the target back down with btrfs_destroy_dev_replace_tgtdev() - except the mark_block_group_to_copy() failure, which returns directly. The target is then leaked: it stays on the device list with its block device held until the filesystem is unmounted. Goto leave like the other post-open error paths so the target is destroyed. Fixes: 78ce9fc269af ("btrfs: zoned: mark block groups to copy for device-replace") Signed-off-by: Christian Brauner (Amutable) --- fs/btrfs/dev-replace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index 8f8fa14886de..0112aa6d7ab1 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -624,7 +624,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, ret = mark_block_group_to_copy(fs_info, src_device); if (ret) - return ret; + goto leave; down_write(&dev_replace->rwsem); dev_replace->replace_task = current; -- 2.47.3