[lvc-project] [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write()

[Filipe Manana]

On Mon, Jul 27, 2026 at 12:54 PM Dmitry Antipov <dmantipov at yandex.ru> wrote:
>
> Local fuzzing of 6.12.94 has found the following memory leak:
>
> Unreferenced object 0xffff888018050a80 (size 64):
>   comm "syz.0.17", pid 10297, jiffies 4294953601
>   hex dump (first 32 bytes):
>     00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
>     10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff  ................
>   backtrace (crc a8a6fc29):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
>     slab_post_alloc_hook mm/slub.c:4152 [inline]
>     slab_alloc_node mm/slub.c:4197 [inline]
>     __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
>     kmalloc_noprof include/linux/slab.h:878 [inline]
>     extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
>     qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
>     btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
>     btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
>     btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
>     btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
>     btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
>     btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
>     vfs_ioctl fs/ioctl.c:51 [inline]
>     __do_sys_ioctl fs/ioctl.c:906 [inline]
>     __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
>     do_syscall_x64 arch/x86/entry/common.c:47 [inline]
>     do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Unreferenced object 0xffff888018050a00 (size 64):
>   comm "syz.0.17", pid 10297, jiffies 4294953601
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00  ................
>     90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff  ................
>   backtrace (crc cb5c9580):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
>     slab_post_alloc_hook mm/slub.c:4152 [inline]
>     slab_alloc_node mm/slub.c:4197 [inline]
>     __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
>     kmalloc_noprof include/linux/slab.h:878 [inline]
>     kzalloc_noprof include/linux/slab.h:1014 [inline]
>     ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
>     extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
>     __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
>     set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
>     qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
>     btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
>     btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
>     btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
>     btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
>     btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
>     btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
>     vfs_ioctl fs/ioctl.c:51 [inline]
>     __do_sys_ioctl fs/ioctl.c:906 [inline]
>     __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
>     do_syscall_x64 arch/x86/entry/common.c:47 [inline]
>     do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fix this by freeing an extent changeset before returning from
> 'btrfs_do_encoded_write()'.
>
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>

Looks good, thans. I added it to the github for-next branch with the
addition of:

Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")

Reviewed-by: Filipe Manana <fdmanana at suse.com>

> ---
> To whom it may be interesting, C reproducer is available at:
> https://drive.google.com/file/d/1KxCiyW9Ewsh9ySEyxaz1FWN9s9FdJLIY/view?usp=sharing
> ---
>  fs/btrfs/inode.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index b446c3014b24..1ad41087b94c 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -9954,6 +9954,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
>         if (cb)
>                 cleanup_compressed_bio(cb);
>  out:
> +       extent_changeset_free(data_reserved);
>         if (ret >= 0)
>                 iocb->ki_pos += encoded->len;
>         return ret;
> --
> 2.55.0
>
>