BUG: memory leak
unreferenced object 0xffff8881205e0480 (size 64):
  comm "syz-executor.5", pid 5943, jiffies 4294946662
  hex dump (first 32 bytes):
    00 00 23 00 00 00 00 00 ff ff 23 00 00 00 00 00  ..#.......#.....
    00 37 f1 07 00 c9 ff ff 00 37 f1 07 00 c9 ff ff  .7.......7......
  backtrace (crc 877ae76a):
    [<ffffffff8166dac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff8166dac2>] slab_post_alloc_hook mm/slub.c:3944 [inline]
    [<ffffffff8166dac2>] slab_alloc_node mm/slub.c:4002 [inline]
    [<ffffffff8166dac2>] kmalloc_trace_noprof+0x282/0x320 mm/slub.c:4149
    [<ffffffff8224c11b>] kmalloc_noprof include/linux/slab.h:660 [inline]
    [<ffffffff8224c11b>] ulist_add_merge fs/btrfs/ulist.c:209 [inline]
    [<ffffffff8224c11b>] ulist_add_merge+0xcb/0x2b0 fs/btrfs/ulist.c:197
    [<ffffffff822a36f6>] add_extent_changeset fs/btrfs/extent-io-tree.c:215 [inline]
    [<ffffffff822a36f6>] add_extent_changeset fs/btrfs/extent-io-tree.c:202 [inline]
    [<ffffffff822a36f6>] clear_state_bit+0xa6/0x210 fs/btrfs/extent-io-tree.c:582
    [<ffffffff822a491b>] __clear_extent_bit+0x42b/0x860 fs/btrfs/extent-io-tree.c:754
    [<ffffffff82257ad2>] __btrfs_qgroup_release_data+0x232/0x4c0 fs/btrfs/qgroup.c:4269
    [<ffffffff821c96d5>] alloc_ordered_extent+0x75/0x300 fs/btrfs/ordered-data.c:159
    [<ffffffff821c9f38>] btrfs_alloc_ordered_extent+0x78/0x500 fs/btrfs/ordered-data.c:274
    [<ffffffff821928ea>] btrfs_create_dio_extent+0xba/0x1b0 fs/btrfs/inode.c:7011
    [<ffffffff821a83df>] btrfs_get_blocks_direct_write fs/btrfs/inode.c:7435 [inline]
    [<ffffffff821a83df>] btrfs_dio_iomap_begin+0xcaf/0x1180 fs/btrfs/inode.c:7686
    [<ffffffff81809ee3>] iomap_iter+0x223/0x560 fs/iomap/iter.c:91
    [<ffffffff8181167f>] __iomap_dio_rw+0x29f/0xce0 fs/iomap/direct-io.c:659
    [<ffffffff821a89e3>] btrfs_dio_write+0x73/0xa0 fs/btrfs/inode.c:7890
    [<ffffffff821b4a2d>] btrfs_direct_write fs/btrfs/file.c:1554 [inline]
    [<ffffffff821b4a2d>] btrfs_do_write_iter+0x44d/0x960 fs/btrfs/file.c:1695
    [<ffffffff8178b9eb>] iter_file_splice_write+0x49b/0x800 fs/splice.c:743
    [<ffffffff8178a793>] do_splice_from fs/splice.c:941 [inline]
    [<ffffffff8178a793>] direct_splice_actor+0x83/0x220 fs/splice.c:1164
    [<ffffffff8178a326>] splice_direct_to_actor+0x166/0x400 fs/splice.c:1108