syzbot

 sign-in | mailing list | source | docs
🐞 Open [1483]
≡ Subsystems
🐞 Fixed [6786]
🐞 Invalid [17525]
⬇ Missing Backports [221]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in qgroup_reserve_data

Status: upstream: reported C repro on 2025/12/11 06:23
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+2f8aa76e6acc9fce6638@syzkaller.appspotmail.com
First crash: 3d19h, last: 3d19h
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] btrfs: fix qgroup extent_changeset leak in page_mkwrite 2 (2) 2025/12/12 06:34
[syzbot] [btrfs?] memory leak in qgroup_reserve_data 1 (4) 2025/12/12 04:07
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2025/12/12 04:07 21m eraykrdg1@gmail.com patch upstream OK log
2025/12/11 11:37 54m eadavis@qq.com patch upstream error

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888108c93440 (size 64):
  comm "syz.0.25", pid 6287, jiffies 4294945820
  hex dump (first 32 bytes):
    00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    50 36 c9 08 81 88 ff ff 50 36 c9 08 81 88 ff ff  P6......P6......
  backtrace (crc 5115bfd6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    extent_changeset_alloc fs/btrfs/extent_io.h:203 [inline]
    qgroup_reserve_data+0x42c/0x4d0 fs/btrfs/qgroup.c:4199
    btrfs_qgroup_reserve_data+0x9a/0xb0 fs/btrfs/qgroup.c:4257
    btrfs_check_data_free_space+0x101/0x200 fs/btrfs/delalloc-space.c:164
    btrfs_page_mkwrite+0x180/0xd30 fs/btrfs/file.c:1888
    do_page_mkwrite+0x6c/0x100 mm/memory.c:3528
    wp_page_shared mm/memory.c:3929 [inline]
    do_wp_page+0x4fe/0x1d50 mm/memory.c:4148
    handle_pte_fault mm/memory.c:6289 [inline]
    __handle_mm_fault+0x125f/0x1e50 mm/memory.c:6411
    handle_mm_fault+0x31c/0x630 mm/memory.c:6580
    do_user_addr_fault+0x34f/0xba0 arch/x86/mm/fault.c:1336
    handle_page_fault arch/x86/mm/fault.c:1476 [inline]
    exc_page_fault+0x64/0xb0 arch/x86/mm/fault.c:1532
    asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

BUG: memory leak
unreferenced object 0xffff888108c93640 (size 64):
  comm "syz.0.25", pid 6287, jiffies 4294945820
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00  ................
    50 34 c9 08 81 88 ff ff 50 34 c9 08 81 88 ff ff  P4......P4......
  backtrace (crc d90ae07a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    ulist_prealloc+0x7a/0xd0 fs/btrfs/ulist.c:114
    extent_changeset_prealloc fs/btrfs/extent_io.h:213 [inline]
    set_extent_bit+0x104/0xc40 fs/btrfs/extent-io-tree.c:1083
    btrfs_set_record_extent_bits+0x56/0xa0 fs/btrfs/extent-io-tree.c:1868
    qgroup_reserve_data+0x116/0x4d0 fs/btrfs/qgroup.c:4206
    btrfs_qgroup_reserve_data+0x9a/0xb0 fs/btrfs/qgroup.c:4257
    btrfs_check_data_free_space+0x101/0x200 fs/btrfs/delalloc-space.c:164
    btrfs_page_mkwrite+0x180/0xd30 fs/btrfs/file.c:1888
    do_page_mkwrite+0x6c/0x100 mm/memory.c:3528
    wp_page_shared mm/memory.c:3929 [inline]
    do_wp_page+0x4fe/0x1d50 mm/memory.c:4148
    handle_pte_fault mm/memory.c:6289 [inline]
    __handle_mm_fault+0x125f/0x1e50 mm/memory.c:6411
    handle_mm_fault+0x31c/0x630 mm/memory.c:6580
    do_user_addr_fault+0x34f/0xba0 arch/x86/mm/fault.c:1336
    handle_page_fault arch/x86/mm/fault.c:1476 [inline]
    exc_page_fault+0x64/0xb0 arch/x86/mm/fault.c:1532
    asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

BUG: memory leak
unreferenced object 0xffff8881294d0cc0 (size 64):
  comm "syz.0.25", pid 6288, jiffies 4294945820
  hex dump (first 32 bytes):
    00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    d0 03 4d 29 81 88 ff ff d0 03 4d 29 81 88 ff ff  ..M)......M)....
  backtrace (crc 99a57742):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    extent_changeset_alloc fs/btrfs/extent_io.h:203 [inline]
    qgroup_reserve_data+0x42c/0x4d0 fs/btrfs/qgroup.c:4199
    btrfs_qgroup_reserve_data+0x9a/0xb0 fs/btrfs/qgroup.c:4257
    btrfs_check_data_free_space+0x101/0x200 fs/btrfs/delalloc-space.c:164
    btrfs_page_mkwrite+0x180/0xd30 fs/btrfs/file.c:1888
    do_page_mkwrite+0x6c/0x100 mm/memory.c:3528
    wp_page_shared mm/memory.c:3929 [inline]
    do_wp_page+0x4fe/0x1d50 mm/memory.c:4148
    handle_pte_fault mm/memory.c:6289 [inline]
    __handle_mm_fault+0x125f/0x1e50 mm/memory.c:6411
    handle_mm_fault+0x31c/0x630 mm/memory.c:6580
    do_user_addr_fault+0x239/0xba0 arch/x86/mm/fault.c:1387
    handle_page_fault arch/x86/mm/fault.c:1476 [inline]
    exc_page_fault+0x64/0xb0 arch/x86/mm/fault.c:1532
    asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

BUG: memory leak
unreferenced object 0xffff8881294d03c0 (size 64):
  comm "syz.0.25", pid 6288, jiffies 4294945820
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00  ................
    d0 0c 4d 29 81 88 ff ff d0 0c 4d 29 81 88 ff ff  ..M)......M)....
  backtrace (crc edd2342):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    ulist_prealloc+0x7a/0xd0 fs/btrfs/ulist.c:114
    extent_changeset_prealloc fs/btrfs/extent_io.h:213 [inline]
    set_extent_bit+0x104/0xc40 fs/btrfs/extent-io-tree.c:1083
    btrfs_set_record_extent_bits+0x56/0xa0 fs/btrfs/extent-io-tree.c:1868
    qgroup_reserve_data+0x116/0x4d0 fs/btrfs/qgroup.c:4206
    btrfs_qgroup_reserve_data+0x9a/0xb0 fs/btrfs/qgroup.c:4257
    btrfs_check_data_free_space+0x101/0x200 fs/btrfs/delalloc-space.c:164
    btrfs_page_mkwrite+0x180/0xd30 fs/btrfs/file.c:1888
    do_page_mkwrite+0x6c/0x100 mm/memory.c:3528
    wp_page_shared mm/memory.c:3929 [inline]
    do_wp_page+0x4fe/0x1d50 mm/memory.c:4148
    handle_pte_fault mm/memory.c:6289 [inline]
    __handle_mm_fault+0x125f/0x1e50 mm/memory.c:6411
    handle_mm_fault+0x31c/0x630 mm/memory.c:6580
    do_user_addr_fault+0x239/0xba0 arch/x86/mm/fault.c:1387
    handle_page_fault arch/x86/mm/fault.c:1476 [inline]
    exc_page_fault+0x64/0xb0 arch/x86/mm/fault.c:1532
    asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

BUG: memory leak
unreferenced object 0xffff888108c93600 (size 64):
  comm "syz.0.25", pid 6287, jiffies 4294945820
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    10 36 c9 08 81 88 ff ff 10 36 c9 08 81 88 ff ff  .6.......6......
  backtrace (crc cafc2d90):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    extent_changeset_alloc fs/btrfs/extent_io.h:203 [inline]
    qgroup_reserve_data+0x42c/0x4d0 fs/btrfs/qgroup.c:4199
    btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4250
    btrfs_check_data_free_space+0x101/0x200 fs/btrfs/delalloc-space.c:164
    btrfs_page_mkwrite+0x180/0xd30 fs/btrfs/file.c:1888
    do_page_mkwrite+0x6c/0x100 mm/memory.c:3528
    wp_page_shared mm/memory.c:3929 [inline]
    do_wp_page+0x4fe/0x1d50 mm/memory.c:4148
    handle_pte_fault mm/memory.c:6289 [inline]
    __handle_mm_fault+0x125f/0x1e50 mm/memory.c:6411
    handle_mm_fault+0x31c/0x630 mm/memory.c:6580
    do_user_addr_fault+0x34f/0xba0 arch/x86/mm/fault.c:1336
    handle_page_fault arch/x86/mm/fault.c:1476 [inline]
    exc_page_fault+0x64/0xb0 arch/x86/mm/fault.c:1532
    asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/08 15:16 upstream ba65a4e7120a d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-upstream-gce-leak memory leak in qgroup_reserve_data
* Struck through repros no longer work on HEAD.