BUG: memory leak
unreferenced object 0xffff88811c8e5440 (size 64):
  comm "syz-executor.0", pid 5806, jiffies 4294945088
  hex dump (first 32 bytes):
    00 00 6f 00 00 00 00 00 ff ff 6f 00 00 00 00 00  ..o.......o.....
    00 f7 7c 07 00 c9 ff ff 00 f7 7c 07 00 c9 ff ff  ..|.......|.....
  backtrace (crc 347e061f):
    [<ffffffff815f0693>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff815f0693>] slab_post_alloc_hook mm/slub.c:3817 [inline]
    [<ffffffff815f0693>] slab_alloc_node mm/slub.c:3860 [inline]
    [<ffffffff815f0693>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
    [<ffffffff8216fb6b>] kmalloc include/linux/slab.h:590 [inline]
    [<ffffffff8216fb6b>] ulist_add_merge fs/btrfs/ulist.c:210 [inline]
    [<ffffffff8216fb6b>] ulist_add_merge+0xcb/0x2b0 fs/btrfs/ulist.c:198
    [<ffffffff821c4096>] add_extent_changeset fs/btrfs/extent-io-tree.c:215 [inline]
    [<ffffffff821c4096>] add_extent_changeset fs/btrfs/extent-io-tree.c:202 [inline]
    [<ffffffff821c4096>] clear_state_bit+0xa6/0x210 fs/btrfs/extent-io-tree.c:582
    [<ffffffff821c52a2>] __clear_extent_bit+0x432/0x860 fs/btrfs/extent-io-tree.c:754
    [<ffffffff8217acae>] __btrfs_qgroup_release_data+0x22e/0x4c0 fs/btrfs/qgroup.c:4140
    [<ffffffff820ef895>] alloc_ordered_extent+0x75/0x300 fs/btrfs/ordered-data.c:160
    [<ffffffff820f00c8>] btrfs_alloc_ordered_extent+0x78/0x4f0 fs/btrfs/ordered-data.c:275
    [<ffffffff820b8bda>] btrfs_create_dio_extent+0xba/0x1b0 fs/btrfs/inode.c:6973
    [<ffffffff820cf9b6>] btrfs_get_blocks_direct_write fs/btrfs/inode.c:7361 [inline]
    [<ffffffff820cf9b6>] btrfs_dio_iomap_begin+0xca6/0x1190 fs/btrfs/inode.c:7612
    [<ffffffff8177582e>] iomap_iter+0x21e/0x560 fs/iomap/iter.c:91
    [<ffffffff8177cd7b>] __iomap_dio_rw+0x2bb/0xcd0 fs/iomap/direct-io.c:658
    [<ffffffff820cffb3>] btrfs_dio_write+0x73/0xa0 fs/btrfs/inode.c:7816
    [<ffffffff820db034>] btrfs_direct_write fs/btrfs/file.c:1546 [inline]
    [<ffffffff820db034>] btrfs_do_write_iter+0x454/0x960 fs/btrfs/file.c:1687
    [<ffffffff816fe72f>] call_write_iter include/linux/fs.h:2085 [inline]
    [<ffffffff816fe72f>] iter_file_splice_write+0x49f/0x7f0 fs/splice.c:743
    [<ffffffff816fd5b3>] do_splice_from fs/splice.c:941 [inline]
    [<ffffffff816fd5b3>] direct_splice_actor+0x83/0x220 fs/splice.c:1164
    [<ffffffff816fd187>] splice_direct_to_actor+0x167/0x3f0 fs/splice.c:1108