BUG: memory leak
unreferenced object 0xffff88810d643400 (size 64):
  comm "syz-executor336", pid 5051, jiffies 4294964407 (age 33.690s)
  hex dump (first 32 bytes):
    03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81545b34>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
    [<ffffffff8213c4ca>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff8213c4ca>] add_tree_block+0x3a/0x220 fs/btrfs/ref-verify.c:319
    [<ffffffff8213da75>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff8202b9f1>] open_ctree+0x12d1/0x2360 fs/btrfs/disk-io.c:3711
    [<ffffffff81ff3523>] btrfs_fill_super fs/btrfs/super.c:1156 [inline]
    [<ffffffff81ff3523>] btrfs_mount_root+0x583/0x710 fs/btrfs/super.c:1524
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81698f71>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81698f71>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81699000>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81ff756d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1584
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff816a0ba3>] do_new_mount fs/namespace.c:3039 [inline]
    [<ffffffff816a0ba3>] path_mount+0xc53/0x10f0 fs/namespace.c:3369
    [<ffffffff816a17e2>] do_mount fs/namespace.c:3382 [inline]
    [<ffffffff816a17e2>] __do_sys_mount fs/namespace.c:3591 [inline]
    [<ffffffff816a17e2>] __se_sys_mount fs/namespace.c:3568 [inline]
    [<ffffffff816a17e2>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3568
    [<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810d643740 (size 64):
  comm "syz-executor336", pid 5051, jiffies 4294964407 (age 33.690s)
  hex dump (first 32 bytes):
    03 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81545b34>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
    [<ffffffff8213be75>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff8213be75>] kzalloc include/linux/slab.h:680 [inline]
    [<ffffffff8213be75>] add_block_entry+0x35/0x320 fs/btrfs/ref-verify.c:270
    [<ffffffff8213c52e>] add_tree_block+0x9e/0x220 fs/btrfs/ref-verify.c:332
    [<ffffffff8213da75>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff8202b9f1>] open_ctree+0x12d1/0x2360 fs/btrfs/disk-io.c:3711
    [<ffffffff81ff3523>] btrfs_fill_super fs/btrfs/super.c:1156 [inline]
    [<ffffffff81ff3523>] btrfs_mount_root+0x583/0x710 fs/btrfs/super.c:1524
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81698f71>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81698f71>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81699000>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81ff756d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1584
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff816a0ba3>] do_new_mount fs/namespace.c:3039 [inline]
    [<ffffffff816a0ba3>] path_mount+0xc53/0x10f0 fs/namespace.c:3369
    [<ffffffff816a17e2>] do_mount fs/namespace.c:3382 [inline]
    [<ffffffff816a17e2>] __do_sys_mount fs/namespace.c:3591 [inline]
    [<ffffffff816a17e2>] __se_sys_mount fs/namespace.c:3568 [inline]
    [<ffffffff816a17e2>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3568
    [<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80

BUG: memory leak
unreferenced object 0xffff88810a10bb00 (size 96):
  comm "syz-executor336", pid 5051, jiffies 4294964407 (age 33.690s)
  hex dump (first 32 bytes):
    00 10 10 00 00 00 00 00 00 10 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00  ................
  backtrace:
    [<ffffffff81545b34>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
    [<ffffffff8213be8e>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff8213be8e>] kzalloc include/linux/slab.h:680 [inline]
    [<ffffffff8213be8e>] add_block_entry+0x4e/0x320 fs/btrfs/ref-verify.c:271
    [<ffffffff8213c52e>] add_tree_block+0x9e/0x220 fs/btrfs/ref-verify.c:332
    [<ffffffff8213da75>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff8202b9f1>] open_ctree+0x12d1/0x2360 fs/btrfs/disk-io.c:3711
    [<ffffffff81ff3523>] btrfs_fill_super fs/btrfs/super.c:1156 [inline]
    [<ffffffff81ff3523>] btrfs_mount_root+0x583/0x710 fs/btrfs/super.c:1524
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81698f71>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81698f71>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81699000>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81ff756d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1584
    [<ffffffff816c414f>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8165d88c>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff816a0ba3>] do_new_mount fs/namespace.c:3039 [inline]
    [<ffffffff816a0ba3>] path_mount+0xc53/0x10f0 fs/namespace.c:3369
    [<ffffffff816a17e2>] do_mount fs/namespace.c:3382 [inline]
    [<ffffffff816a17e2>] __do_sys_mount fs/namespace.c:3591 [inline]
    [<ffffffff816a17e2>] __se_sys_mount fs/namespace.c:3568 [inline]
    [<ffffffff816a17e2>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3568
    [<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80