[PATCH] btrfs: fix extent changeset leak in encoded writes

[PATCH] btrfs: fix extent changeset leak in encoded writes

[Breno Leitao]

Investigating some machines with kmemleak, I am constantly seeing
the following memory leak that seems real.

  kmemleak: unreferenced object 0xffff88869f7d01c0 (size 64):
  kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
  kmemleak:   backtrace (crc ab59040a):
  kmemleak:     __kmalloc_cache_noprof
  kmemleak:     qgroup_reserve_data
  kmemleak:     btrfs_qgroup_reserve_data
  kmemleak:     btrfs_do_encoded_write
  kmemleak:     btrfs_do_write_iter
  kmemleak:     btrfs_ioctl_encoded_write
  kmemleak:     btrfs_ioctl
  kmemleak:   ... and 2 more object(s) with the same backtrace

and

  kmemleak: unreferenced object 0xffff88830d94edc0 (size 64):
  kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
<snip>
  kmemleak:   ... and 2 more object(s) with the same backtrace

Looking at the code, it seems we don't free data_reserved, but
we should (!?). I was able to come up with a xfstest test that exposes
the kmemleak above:

https://github.com/leitao/xfstest/commit/81c83a3fbb20b4ad695055ede7fcb73d3ffa2e52

Free the changeset on the way out, as every other caller of
btrfs_qgroup_reserve_data() already does.

Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 fs/btrfs/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0fcbfc3939462..f8ad96256ff67 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9965,6 +9965,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
 	if (cb)
 		cleanup_compressed_bio(cb);
 out:
+	extent_changeset_free(data_reserved);
 	if (ret >= 0)
 		iocb->ki_pos += encoded->len;
 	return ret;

---
base-commit: 95d6a9ccef99117115e41e9adb271243bd5e985b
change-id: 20260731-btrfs_kmemleak-d44637bd2518

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] btrfs: fix extent changeset leak in encoded writes

[Filipe Manana]

On Fri, Jul 31, 2026 at 12:52 PM Breno Leitao <leitao@debian.org> wrote:
>
> Investigating some machines with kmemleak, I am constantly seeing
> the following memory leak that seems real.
>
>   kmemleak: unreferenced object 0xffff88869f7d01c0 (size 64):
>   kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
>   kmemleak:   backtrace (crc ab59040a):
>   kmemleak:     __kmalloc_cache_noprof
>   kmemleak:     qgroup_reserve_data
>   kmemleak:     btrfs_qgroup_reserve_data
>   kmemleak:     btrfs_do_encoded_write
>   kmemleak:     btrfs_do_write_iter
>   kmemleak:     btrfs_ioctl_encoded_write
>   kmemleak:     btrfs_ioctl
>   kmemleak:   ... and 2 more object(s) with the same backtrace
>
> and
>
>   kmemleak: unreferenced object 0xffff88830d94edc0 (size 64):
>   kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
> <snip>
>   kmemleak:   ... and 2 more object(s) with the same backtrace
>
> Looking at the code, it seems we don't free data_reserved, but
> we should (!?). I was able to come up with a xfstest test that exposes
> the kmemleak above:
>
> https://github.com/leitao/xfstest/commit/81c83a3fbb20b4ad695055ede7fcb73d3ffa2e52
>
> Free the changeset on the way out, as every other caller of
> btrfs_qgroup_reserve_data() already does.
>
> Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")
> Cc: stable@vger.kernel.org
> Signed-off-by: Breno Leitao <leitao@debian.org>

This is already fixed here:

https://lore.kernel.org/linux-btrfs/20260727115352.12622-1-dmantipov@yandex.ru/

Thanks.

> ---
>  fs/btrfs/inode.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 0fcbfc3939462..f8ad96256ff67 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -9965,6 +9965,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
>         if (cb)
>                 cleanup_compressed_bio(cb);
>  out:
> +       extent_changeset_free(data_reserved);
>         if (ret >= 0)
>                 iocb->ki_pos += encoded->len;
>         return ret;
>
> ---
> base-commit: 95d6a9ccef99117115e41e9adb271243bd5e985b
> change-id: 20260731-btrfs_kmemleak-d44637bd2518
>
> Best regards,
> --
> Breno Leitao <leitao@debian.org>
>
>

Re: [PATCH] btrfs: fix extent changeset leak in encoded writes

[David Sterba]

On Fri, Jul 31, 2026 at 12:56:20PM +0100, Filipe Manana wrote:
> On Fri, Jul 31, 2026 at 12:52 PM Breno Leitao <leitao@debian.org> wrote:
> >
> > Investigating some machines with kmemleak, I am constantly seeing
> > the following memory leak that seems real.
> >
> >   kmemleak: unreferenced object 0xffff88869f7d01c0 (size 64):
> >   kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
> >   kmemleak:   backtrace (crc ab59040a):
> >   kmemleak:     __kmalloc_cache_noprof
> >   kmemleak:     qgroup_reserve_data
> >   kmemleak:     btrfs_qgroup_reserve_data
> >   kmemleak:     btrfs_do_encoded_write
> >   kmemleak:     btrfs_do_write_iter
> >   kmemleak:     btrfs_ioctl_encoded_write
> >   kmemleak:     btrfs_ioctl
> >   kmemleak:   ... and 2 more object(s) with the same backtrace
> >
> > and
> >
> >   kmemleak: unreferenced object 0xffff88830d94edc0 (size 64):
> >   kmemleak:   comm "btrfs", pid 1613416, jiffies 4316358595
> > <snip>
> >   kmemleak:   ... and 2 more object(s) with the same backtrace
> >
> > Looking at the code, it seems we don't free data_reserved, but
> > we should (!?). I was able to come up with a xfstest test that exposes
> > the kmemleak above:
> >
> > https://github.com/leitao/xfstest/commit/81c83a3fbb20b4ad695055ede7fcb73d3ffa2e52
> >
> > Free the changeset on the way out, as every other caller of
> > btrfs_qgroup_reserve_data() already does.
> >
> > Fixes: 7c0c7269f7b5 ("btrfs: add BTRFS_IOC_ENCODED_WRITE")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Breno Leitao <leitao@debian.org>
> 
> This is already fixed here:
> 
> https://lore.kernel.org/linux-btrfs/20260727115352.12622-1-dmantipov@yandex.ru/

Will be sent next week.