[syzbot] [btrfs?] [ntfs3?] memory leak in __pcs_replace_empty_main

[syzbot <syzbot+527fed49e5b988882c9a@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    8a65162514fb Merge tag 'driver-core-7.4-rc2' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=149c9409580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4361b1bb937ae1c4
dashboard link: https://syzkaller.appspot.com/bug?extid=527fed49e5b988882c9a
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=129c9409580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4cd10f0ff0b1/disk-8a651625.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/055634bde6e5/vmlinux-8a651625.xz
kernel image: https://storage.googleapis.com/syzbot-assets/523697a102d6/bzImage-8a651625.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/6cf790da15a7/mount_0.gz
  fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=17c154d9580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/9fee673d5c4a/mount_11.gz
  fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=1161e7a5580000)
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/5f1986de5655/mount_13.gz

AI-generated root cause summary:
In SLUB's per-CPU sheaves (PCS) implementation (mm/slub.c), struct slab_sheaf
objects allocated via __alloc_empty_sheaf() are tracked as standard heap
allocations by kmemleak. When an rcu_free sheaf reaches capacity in
__kfree_rcu_sheaf(), it is detached from pcs->rcu_free and queued for deferred
cleanup via call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf). While queued, the
only pointer to the sheaf exists in RCU's segmented callback list
(rcu_data.cblist); if any earlier callback in the singly-linked list resides in
memory untracked or unscanned by kmemleak (such as struct slab allocated in
struct page, SLAB_NOLEAKTRACE objects, or already-freed objects), kmemleak
cannot traverse the chain. Because recycled sheaves retain their early-boot
allocation timestamps, kmemleak exceeds its scan age threshold and falsely
reports these in-flight sheaves as unreferenced memory leaks.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=527fed49e5b988882c9a

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+527fed49e5b988882c9a@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88810005f600 (size 512):
  comm "swapper/0", pid 0, jiffies 4294937296
  hex dump (first 32 bytes):
    e0 79 f0 2b 81 88 ff ff 20 00 b4 81 ff ff ff ff  .y.+.... .......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 9e0404a6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_empty_main+0x260/0x2e0 mm/slub.c:4806
    alloc_from_pcs mm/slub.c:4887 [inline]
    slab_alloc_node mm/slub.c:5021 [inline]
    __kmalloc_cache_noprof+0x370/0x3f0 mm/slub.c:5676
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    __irq_domain_alloc_fwnode+0x37/0x160 kernel/irq/irqdomain.c:97
    irq_domain_alloc_named_fwnode include/linux/irqdomain.h:271 [inline]
    arch_early_irq_init+0x1c/0x70 arch/x86/kernel/apic/vector.c:803
    start_kernel+0x9c5/0xc10 init/main.c:1150
    x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
    x86_64_start_kernel+0xce/0xd0 arch/x86/kernel/head64.c:291
    common_startup_64+0x13e/0x158

BUG: memory leak
unreferenced object 0xffff8881009c5000 (size 512):
  comm "kthreadd", pid 2, jiffies 4294937342
  hex dump (first 32 bytes):
    a0 5c 9b 2a 81 88 ff ff 20 00 b4 81 ff ff ff ff  .\.*.... .......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 3e15a3c6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_empty_main+0x260/0x2e0 mm/slub.c:4806
    alloc_from_pcs mm/slub.c:4887 [inline]
    slab_alloc_node mm/slub.c:5021 [inline]
    __kmalloc_cache_node_noprof+0x381/0x410 mm/slub.c:5695
    _kmalloc_node_noprof include/linux/slab.h:1196 [inline]
    __get_vm_area_node+0xe9/0x1f0 mm/vmalloc.c:3270
    __vmalloc_node_range_noprof+0x1e1/0xd90 mm/vmalloc.c:4112
    __vmalloc_node_noprof+0x71/0x90 mm/vmalloc.c:4213
    alloc_thread_stack_node kernel/fork.c:359 [inline]
    dup_task_struct kernel/fork.c:931 [inline]
    copy_process+0x527/0x3060 kernel/fork.c:2150
    kernel_clone+0x101/0x710 kernel/fork.c:2798
    kernel_thread+0x80/0xb0 kernel/fork.c:2859
    create_kthread kernel/kthread.c:459 [inline]
    kthreadd+0x186/0x250 kernel/kthread.c:817
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888102d99800 (size 512):
  comm "kworker/u8:3", pid 235, jiffies 4294937447
  hex dump (first 32 bytes):
    f0 6b 9d 2a 81 88 ff ff 20 00 b4 81 ff ff ff ff  .k.*.... .......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 282505aa):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    call_usermodehelper_freeinfo kernel/umh.c:43 [inline]
    umh_complete kernel/umh.c:57 [inline]
    call_usermodehelper_exec_async+0x1c7/0x1f0 kernel/umh.c:117
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888101943a00 (size 512):
  comm "kdevtmpfs", pid 27, jiffies 4294937449
  hex dump (first 32 bytes):
    b0 c3 b7 0b 81 88 ff ff 20 00 b4 81 ff ff ff ff  ........ .......
    00 4a 04 00 81 88 ff ff 20 00 00 00 00 00 00 00  .J...... .......
  backtrace (crc 6be06b44):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __kfree_rcu_sheaf+0x1aa/0x2d0 mm/slub.c:6282
    kfree_rcu_sheaf mm/slab_common.c:1689 [inline]
    kvfree_call_rcu+0x1ef/0x3a0 mm/slab_common.c:2044
    ma_free_rcu lib/maple_tree.c:173 [inline]
    ma_free_rcu+0x29/0x40 lib/maple_tree.c:170
    mas_topiary_node lib/maple_tree.c:1829 [inline]
    mas_topiary_node lib/maple_tree.c:1817 [inline]
    mas_topiary_replace+0xc49/0x1560 lib/maple_tree.c:1928
    mas_wmb_replace+0x3c/0x630 lib/maple_tree.c:2114
    mas_wr_split+0xcda/0x1650 lib/maple_tree.c:3502
    mas_wr_store_entry+0x520/0xf60 lib/maple_tree.c:3575
    mas_insert lib/maple_tree.c:3819 [inline]
    mas_alloc_cyclic+0x481/0xa30 lib/maple_tree.c:3862
    mtree_alloc_cyclic+0xc7/0x140 lib/maple_tree.c:5975
    simple_offset_add+0x5c/0xd0 fs/libfs.c:296
    shmem_mknod+0x1df/0x260 mm/shmem.c:4092
    vfs_mknod+0x229/0x460 fs/namei.c:5287
    handle_create drivers/base/devtmpfs.c:283 [inline]
    handle drivers/base/devtmpfs.c:435 [inline]
    devtmpfs_work_loop+0x292/0x64b drivers/base/devtmpfs.c:450
    devtmpfsd+0x3a/0x50 drivers/base/devtmpfs.c:492
    kthread+0x150/0x1a0 kernel/kthread.c:436

BUG: memory leak
unreferenced object 0xffff888102d98200 (size 512):
  comm "kworker/0:1", pid 11, jiffies 4294937453
  hex dump (first 32 bytes):
    f0 6b 99 2a 81 88 ff ff 20 00 b4 81 ff ff ff ff  .k.*.... .......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 946da91f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    vfree mm/vmalloc.c:3549 [inline]
    vfree+0xa8/0x390 mm/vmalloc.c:3521
    delayed_vfree_work+0x29/0x40 mm/vmalloc.c:3451
    process_one_work+0x2b7/0x5c0 kernel/workqueue.c:3495
    process_scheduled_works kernel/workqueue.c:3578 [inline]
    worker_thread+0x255/0x4a0 kernel/workqueue.c:3659
    kthread+0x150/0x1a0 kernel/kthread.c:436
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff8881024bee00 (size 512):
  comm "softirq", pid 0, jiffies 4294937453
  hex dump (first 32 bytes):
    70 66 90 2a 81 88 ff ff 20 00 b4 81 ff ff ff ff  pf.*.... .......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 3d09b414):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    security_task_free+0x6e/0x130 security/security.c:2827
    __put_task_struct+0x9f/0x260 kernel/fork.c:792
    rcu_do_batch kernel/rcu/tree.c:2650 [inline]
    rcu_core+0x269/0x720 kernel/rcu/tree.c:2919
    handle_softirqs+0x114/0x330 kernel/softirq.c:669
    __do_softirq kernel/softirq.c:703 [inline]
    invoke_softirq kernel/softirq.c:542 [inline]
    __irq_exit_rcu+0xb5/0xf0 kernel/softirq.c:786
    instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline]
    sysvec_irq_work+0x73/0x80 arch/x86/kernel/irq_work.c:17
    asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:710

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
** replaying previous printk message **


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup