BUG: memory leak
unreferenced object 0xffff88812218e6c0 (size 64):
  comm "syz-executor.1", pid 5827, jiffies 4294945011
  hex dump (first 32 bytes):
    00 00 1d 00 00 00 00 00 ff ff 1d 00 00 00 00 00  ................
    00 77 a3 07 00 c9 ff ff 00 77 a3 07 00 c9 ff ff  .w.......w......
  backtrace (crc c4680ea9):
    [<ffffffff816633e2>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff816633e2>] slab_post_alloc_hook mm/slub.c:3802 [inline]
    [<ffffffff816633e2>] slab_alloc_node mm/slub.c:3845 [inline]
    [<ffffffff816633e2>] kmalloc_trace+0x282/0x330 mm/slub.c:3992
    [<ffffffff8223e07b>] kmalloc include/linux/slab.h:628 [inline]
    [<ffffffff8223e07b>] ulist_add_merge fs/btrfs/ulist.c:209 [inline]
    [<ffffffff8223e07b>] ulist_add_merge+0xcb/0x2b0 fs/btrfs/ulist.c:197
    [<ffffffff82295956>] add_extent_changeset fs/btrfs/extent-io-tree.c:215 [inline]
    [<ffffffff82295956>] add_extent_changeset fs/btrfs/extent-io-tree.c:202 [inline]
    [<ffffffff82295956>] clear_state_bit+0xa6/0x210 fs/btrfs/extent-io-tree.c:582
    [<ffffffff82296b7b>] __clear_extent_bit+0x42b/0x860 fs/btrfs/extent-io-tree.c:754
    [<ffffffff82249962>] __btrfs_qgroup_release_data+0x232/0x4c0 fs/btrfs/qgroup.c:4254
    [<ffffffff821ba795>] alloc_ordered_extent+0x75/0x300 fs/btrfs/ordered-data.c:159
    [<ffffffff821baff8>] btrfs_alloc_ordered_extent+0x78/0x500 fs/btrfs/ordered-data.c:274
    [<ffffffff82183eaa>] btrfs_create_dio_extent+0xba/0x1b0 fs/btrfs/inode.c:7028
    [<ffffffff8219ae7f>] btrfs_get_blocks_direct_write fs/btrfs/inode.c:7416 [inline]
    [<ffffffff8219ae7f>] btrfs_dio_iomap_begin+0xcaf/0x1180 fs/btrfs/inode.c:7667
    [<ffffffff817fe773>] iomap_iter+0x223/0x560 fs/iomap/iter.c:91
    [<ffffffff81805e6f>] __iomap_dio_rw+0x29f/0xce0 fs/iomap/direct-io.c:659
    [<ffffffff8219b483>] btrfs_dio_write+0x73/0xa0 fs/btrfs/inode.c:7871
    [<ffffffff821a649d>] btrfs_direct_write fs/btrfs/file.c:1544 [inline]
    [<ffffffff821a649d>] btrfs_do_write_iter+0x44d/0x960 fs/btrfs/file.c:1685
    [<ffffffff81780ceb>] call_write_iter include/linux/fs.h:2110 [inline]
    [<ffffffff81780ceb>] iter_file_splice_write+0x49b/0x800 fs/splice.c:743
    [<ffffffff8177fa93>] do_splice_from fs/splice.c:941 [inline]
    [<ffffffff8177fa93>] direct_splice_actor+0x83/0x220 fs/splice.c:1164
    [<ffffffff8177f626>] splice_direct_to_actor+0x166/0x400 fs/splice.c:1108