* [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write()
@ 2026-07-27 11:53 Dmitry Antipov
2026-07-27 17:01 ` Filipe Manana
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Antipov @ 2026-07-27 11:53 UTC (permalink / raw)
To: David Sterba, Chris Mason; +Cc: linux-btrfs, lvc-project, Dmitry Antipov
Local fuzzing of 6.12.94 has found the following memory leak:
Unreferenced object 0xffff888018050a80 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601
hex dump (first 32 bytes):
00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................
backtrace (crc a8a6fc29):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Unreferenced object 0xffff888018050a00 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................
90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................
backtrace (crc cb5c9580):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
__set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by freeing an extent changeset before returning from
'btrfs_do_encoded_write()'.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
To whom it may be interesting, C reproducer is available at:
https://drive.google.com/file/d/1KxCiyW9Ewsh9ySEyxaz1FWN9s9FdJLIY/view?usp=sharing
---
fs/btrfs/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b446c3014b24..1ad41087b94c 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9954,6 +9954,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
if (cb)
cleanup_compressed_bio(cb);
out:
+ extent_changeset_free(data_reserved);
if (ret >= 0)
iocb->ki_pos += encoded->len;
return ret;
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write()
2026-07-27 11:53 [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write() Dmitry Antipov
@ 2026-07-27 17:01 ` Filipe Manana
2026-07-31 12:13 ` Breno Leitao
0 siblings, 1 reply; 3+ messages in thread
From: Filipe Manana @ 2026-07-27 17:01 UTC (permalink / raw)
To: Dmitry Antipov; +Cc: David Sterba, Chris Mason, linux-btrfs, lvc-project
On Mon, Jul 27, 2026 at 12:54 PM Dmitry Antipov <dmantipov@yandex.ru> wrote:
>
> Local fuzzing of 6.12.94 has found the following memory leak:
>
> Unreferenced object 0xffff888018050a80 (size 64):
> comm "syz.0.17", pid 10297, jiffies 4294953601
> hex dump (first 32 bytes):
> 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
> 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................
> backtrace (crc a8a6fc29):
> kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
> slab_post_alloc_hook mm/slub.c:4152 [inline]
> slab_alloc_node mm/slub.c:4197 [inline]
> __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
> kmalloc_noprof include/linux/slab.h:878 [inline]
> extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
> qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
> btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
> btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
> btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
> btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
> btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
> btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:47 [inline]
> do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Unreferenced object 0xffff888018050a00 (size 64):
> comm "syz.0.17", pid 10297, jiffies 4294953601
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................
> 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................
> backtrace (crc cb5c9580):
> kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
> slab_post_alloc_hook mm/slub.c:4152 [inline]
> slab_alloc_node mm/slub.c:4197 [inline]
> __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
> kmalloc_noprof include/linux/slab.h:878 [inline]
> kzalloc_noprof include/linux/slab.h:1014 [inline]
> ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
> extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
> __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
> set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
> qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
> btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
> btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
> btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
> btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
> btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
> btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:47 [inline]
> do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fix this by freeing an extent changeset before returning from
> 'btrfs_do_encoded_write()'.
>
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Looks good, thans. I added it to the github for-next branch with the
addition of:
Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")
Reviewed-by: Filipe Manana <fdmanana@suse.com>
> ---
> To whom it may be interesting, C reproducer is available at:
> https://drive.google.com/file/d/1KxCiyW9Ewsh9ySEyxaz1FWN9s9FdJLIY/view?usp=sharing
> ---
> fs/btrfs/inode.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index b446c3014b24..1ad41087b94c 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -9954,6 +9954,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
> if (cb)
> cleanup_compressed_bio(cb);
> out:
> + extent_changeset_free(data_reserved);
> if (ret >= 0)
> iocb->ki_pos += encoded->len;
> return ret;
> --
> 2.55.0
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write()
2026-07-27 17:01 ` Filipe Manana
@ 2026-07-31 12:13 ` Breno Leitao
0 siblings, 0 replies; 3+ messages in thread
From: Breno Leitao @ 2026-07-31 12:13 UTC (permalink / raw)
To: Filipe Manana
Cc: Dmitry Antipov, David Sterba, Chris Mason, linux-btrfs,
lvc-project
On Mon, Jul 27, 2026 at 06:01:34PM +0100, Filipe Manana wrote:
> On Mon, Jul 27, 2026 at 12:54 PM Dmitry Antipov <dmantipov@yandex.ru> wrote:
> > Fix this by freeing an extent changeset before returning from
> > 'btrfs_do_encoded_write()'.
> >
> > Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
>
> Looks good, thans. I added it to the github for-next branch with the
> addition of:
>
> Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")
That looks correct from my investigation as well.
I've spent some time on this one, and this fix looks like correct. Feel
free to add:
Reviewed-by: Breno Leitao <leitao@debian.org>
Tested-by: Breno Leitao <leitao@debian.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-31 12:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-27 11:53 [PATCH] btrfs: fix memory leak in btrfs_do_encoded_write() Dmitry Antipov
2026-07-27 17:01 ` Filipe Manana
2026-07-31 12:13 ` Breno Leitao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox