BUG: memory leak
unreferenced object 0xffff8881098ed5c0 (size 64):
  comm "syz-executor.0", pid 6233, jiffies 4294944012 (age 13.020s)
  hex dump (first 32 bytes):
    03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815375e4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1061
    [<ffffffff8212d6fa>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff8212d6fa>] add_tree_block+0x3a/0x240 fs/btrfs/ref-verify.c:319
    [<ffffffff8212ecc5>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff82016456>] open_ctree+0x12d6/0x2360 fs/btrfs/disk-io.c:3706
    [<ffffffff81fddd33>] btrfs_fill_super fs/btrfs/super.c:1152 [inline]
    [<ffffffff81fddd33>] btrfs_mount_root+0x583/0x6f0 fs/btrfs/super.c:1519
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81685f81>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81685f81>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81686010>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81fe1d0d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1579
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff8168db53>] do_new_mount fs/namespace.c:3042 [inline]
    [<ffffffff8168db53>] path_mount+0xc53/0x10f0 fs/namespace.c:3372
    [<ffffffff8168e792>] do_mount fs/namespace.c:3385 [inline]
    [<ffffffff8168e792>] __do_sys_mount fs/namespace.c:3594 [inline]
    [<ffffffff8168e792>] __se_sys_mount fs/namespace.c:3571 [inline]
    [<ffffffff8168e792>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3571
    [<ffffffff849c6969>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff849c6969>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810a5b5600 (size 64):
  comm "syz-executor.0", pid 6233, jiffies 4294944012 (age 13.030s)
  hex dump (first 32 bytes):
    03 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815375e4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1061
    [<ffffffff8212d0a5>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff8212d0a5>] kzalloc include/linux/slab.h:720 [inline]
    [<ffffffff8212d0a5>] add_block_entry+0x35/0x320 fs/btrfs/ref-verify.c:270
    [<ffffffff8212d75f>] add_tree_block+0x9f/0x240 fs/btrfs/ref-verify.c:332
    [<ffffffff8212ecc5>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff82016456>] open_ctree+0x12d6/0x2360 fs/btrfs/disk-io.c:3706
    [<ffffffff81fddd33>] btrfs_fill_super fs/btrfs/super.c:1152 [inline]
    [<ffffffff81fddd33>] btrfs_mount_root+0x583/0x6f0 fs/btrfs/super.c:1519
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81685f81>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81685f81>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81686010>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81fe1d0d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1579
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff8168db53>] do_new_mount fs/namespace.c:3042 [inline]
    [<ffffffff8168db53>] path_mount+0xc53/0x10f0 fs/namespace.c:3372
    [<ffffffff8168e792>] do_mount fs/namespace.c:3385 [inline]
    [<ffffffff8168e792>] __do_sys_mount fs/namespace.c:3594 [inline]
    [<ffffffff8168e792>] __se_sys_mount fs/namespace.c:3571 [inline]
    [<ffffffff8168e792>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3571
    [<ffffffff849c6969>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff849c6969>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80

BUG: memory leak
unreferenced object 0xffff88810b608e00 (size 96):
  comm "syz-executor.0", pid 6233, jiffies 4294944012 (age 13.030s)
  hex dump (first 32 bytes):
    00 10 10 00 00 00 00 00 00 10 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00  ................
  backtrace:
    [<ffffffff815375e4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1061
    [<ffffffff8212d0be>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff8212d0be>] kzalloc include/linux/slab.h:720 [inline]
    [<ffffffff8212d0be>] add_block_entry+0x4e/0x320 fs/btrfs/ref-verify.c:271
    [<ffffffff8212d75f>] add_tree_block+0x9f/0x240 fs/btrfs/ref-verify.c:332
    [<ffffffff8212ecc5>] btrfs_build_ref_tree+0x535/0x7c0 fs/btrfs/ref-verify.c:474
    [<ffffffff82016456>] open_ctree+0x12d6/0x2360 fs/btrfs/disk-io.c:3706
    [<ffffffff81fddd33>] btrfs_fill_super fs/btrfs/super.c:1152 [inline]
    [<ffffffff81fddd33>] btrfs_mount_root+0x583/0x6f0 fs/btrfs/super.c:1519
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff81685f81>] fc_mount fs/namespace.c:1035 [inline]
    [<ffffffff81685f81>] vfs_kern_mount.part.0+0xd1/0x120 fs/namespace.c:1065
    [<ffffffff81686010>] vfs_kern_mount+0x40/0x60 fs/namespace.c:1052
    [<ffffffff81fe1d0d>] btrfs_mount+0x19d/0x620 fs/btrfs/super.c:1579
    [<ffffffff816b0faf>] legacy_get_tree+0x2f/0x90 fs/fs_context.c:610
    [<ffffffff8164aafc>] vfs_get_tree+0x2c/0x110 fs/super.c:1510
    [<ffffffff8168db53>] do_new_mount fs/namespace.c:3042 [inline]
    [<ffffffff8168db53>] path_mount+0xc53/0x10f0 fs/namespace.c:3372
    [<ffffffff8168e792>] do_mount fs/namespace.c:3385 [inline]
    [<ffffffff8168e792>] __do_sys_mount fs/namespace.c:3594 [inline]
    [<ffffffff8168e792>] __se_sys_mount fs/namespace.c:3571 [inline]
    [<ffffffff8168e792>] __x64_sys_mount+0x192/0x1e0 fs/namespace.c:3571
    [<ffffffff849c6969>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff849c6969>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80