memory leak in btrfs_read_chunk_tree

Status: fixed on 2026/01/21 09:45
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+eadd98df8bceb15d7fed@syzkaller.appspotmail.com
Fix commit: b57f2ddd2873 btrfs: fix memory leak of fs_devices in degraded seed device path
First crash: 247d, last: 247d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] btrfs: fix memory leak of fs_devices in degraded seed device path 3 (3) 2025/12/11 23:55
[syzbot] [btrfs?] memory leak in btrfs_read_chunk_tree 0 (5) 2025/12/10 13:00
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2025/12/10 13:00 21m kartikey406@gmail.com patch upstream OK log
2025/12/10 10:05 1h07m hariconscious@gmail.com patch upstream report log
2025/12/09 16:59 8m hariconscious@gmail.com patch upstream error
2025/12/09 16:53 1m hariconscious@gmail.com patch upstream error

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881092fce00 (size 512):
  comm "syz.0.17", pid 6092, jiffies 4294942574
  hex dump (first 32 bytes):
    00 fe 44 da de 57 40 6a 82 41 57 ec 7d 44 12 cf  ..D..W@j.AW.}D..
    00 fe 44 da de 57 40 6a 82 41 57 ec 7d 44 12 cf  ..D..W@j.AW.}D..
  backtrace (crc d3ac311e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3a6/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    alloc_fs_devices+0x20/0xc0 fs/btrfs/volumes.c:381
    open_seed_devices fs/btrfs/volumes.c:7172 [inline]
    read_one_dev fs/btrfs/volumes.c:7228 [inline]
    btrfs_read_chunk_tree+0xa8f/0xcf0 fs/btrfs/volumes.c:7521
    open_ctree+0xe0a/0x2410 fs/btrfs/disk-io.c:3459
    btrfs_fill_super fs/btrfs/super.c:987 [inline]
    btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
    btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
    btrfs_get_tree+0x735/0xe00 fs/btrfs/super.c:2128
    vfs_get_tree+0x31/0x120 fs/super.c:1759
    fc_mount fs/namespace.c:1199 [inline]
    do_new_mount_fc fs/namespace.c:3636 [inline]
    do_new_mount fs/namespace.c:3712 [inline]
    path_mount+0x5b5/0x1320 fs/namespace.c:4022
    do_mount fs/namespace.c:4035 [inline]
    __do_sys_mount fs/namespace.c:4224 [inline]
    __se_sys_mount fs/namespace.c:4201 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4201
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881251dfc00 (size 1024):
  comm "syz.0.17", pid 6092, jiffies 4294942574
  hex dump (first 32 bytes):
    90 ce 2f 09 81 88 ff ff 90 ce 2f 09 81 88 ff ff  ../......./.....
    10 fc 1d 25 81 88 ff ff 10 fc 1d 25 81 88 ff ff  ...%.......%....
  backtrace (crc 3c4c04f1):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3a6/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    btrfs_alloc_device+0x5c/0x1f0 fs/btrfs/volumes.c:6907
    add_missing_dev+0x4b/0xf0 fs/btrfs/volumes.c:6867
    read_one_dev fs/btrfs/volumes.c:7241 [inline]
    btrfs_read_chunk_tree+0x7cf/0xcf0 fs/btrfs/volumes.c:7521
    open_ctree+0xe0a/0x2410 fs/btrfs/disk-io.c:3459
    btrfs_fill_super fs/btrfs/super.c:987 [inline]
    btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
    btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
    btrfs_get_tree+0x735/0xe00 fs/btrfs/super.c:2128
    vfs_get_tree+0x31/0x120 fs/super.c:1759
    fc_mount fs/namespace.c:1199 [inline]
    do_new_mount_fc fs/namespace.c:3636 [inline]
    do_new_mount fs/namespace.c:3712 [inline]
    path_mount+0x5b5/0x1320 fs/namespace.c:4022
    do_mount fs/namespace.c:4035 [inline]
    __do_sys_mount fs/namespace.c:4224 [inline]
    __se_sys_mount fs/namespace.c:4201 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4201
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126e4a400 (size 512):
  comm "syz.0.18", pid 6135, jiffies 4294942600
  hex dump (first 32 bytes):
    00 fe 44 da de 57 40 6a 82 41 57 ec 7d 44 12 cf  ..D..W@j.AW.}D..
    00 fe 44 da de 57 40 6a 82 41 57 ec 7d 44 12 cf  ..D..W@j.AW.}D..
  backtrace (crc 8b73c9ef):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3a6/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    alloc_fs_devices+0x20/0xc0 fs/btrfs/volumes.c:381
    open_seed_devices fs/btrfs/volumes.c:7172 [inline]
    read_one_dev fs/btrfs/volumes.c:7228 [inline]
    btrfs_read_chunk_tree+0xa8f/0xcf0 fs/btrfs/volumes.c:7521
    open_ctree+0xe0a/0x2410 fs/btrfs/disk-io.c:3459
    btrfs_fill_super fs/btrfs/super.c:987 [inline]
    btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
    btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
    btrfs_get_tree+0x735/0xe00 fs/btrfs/super.c:2128
    vfs_get_tree+0x31/0x120 fs/super.c:1759
    fc_mount fs/namespace.c:1199 [inline]
    do_new_mount_fc fs/namespace.c:3636 [inline]
    do_new_mount fs/namespace.c:3712 [inline]
    path_mount+0x5b5/0x1320 fs/namespace.c:4022
    do_mount fs/namespace.c:4035 [inline]
    __do_sys_mount fs/namespace.c:4224 [inline]
    __se_sys_mount fs/namespace.c:4201 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4201
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810ea93000 (size 1024):
  comm "syz.0.18", pid 6135, jiffies 4294942600
  hex dump (first 32 bytes):
    90 a4 e4 26 81 88 ff ff 90 a4 e4 26 81 88 ff ff  ...&.......&....
    10 30 a9 0e 81 88 ff ff 10 30 a9 0e 81 88 ff ff  .0.......0......
  backtrace (crc 2183446):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4953 [inline]
    slab_alloc_node mm/slub.c:5258 [inline]
    __kmalloc_cache_noprof+0x3a6/0x570 mm/slub.c:5766
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    btrfs_alloc_device+0x5c/0x1f0 fs/btrfs/volumes.c:6907
    add_missing_dev+0x4b/0xf0 fs/btrfs/volumes.c:6867
    read_one_dev fs/btrfs/volumes.c:7241 [inline]
    btrfs_read_chunk_tree+0x7cf/0xcf0 fs/btrfs/volumes.c:7521
    open_ctree+0xe0a/0x2410 fs/btrfs/disk-io.c:3459
    btrfs_fill_super fs/btrfs/super.c:987 [inline]
    btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
    btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
    btrfs_get_tree+0x735/0xe00 fs/btrfs/super.c:2128
    vfs_get_tree+0x31/0x120 fs/super.c:1759
    fc_mount fs/namespace.c:1199 [inline]
    do_new_mount_fc fs/namespace.c:3636 [inline]
    do_new_mount fs/namespace.c:3712 [inline]
    path_mount+0x5b5/0x1320 fs/namespace.c:4022
    do_mount fs/namespace.c:4035 [inline]
    __do_sys_mount fs/namespace.c:4224 [inline]
    __se_sys_mount fs/namespace.c:4201 [inline]
    __x64_sys_mount+0x1a2/0x1e0 fs/namespace.c:4201
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/04 13:14 upstream 8f7aa3d3c732 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-leak memory leak in btrfs_read_chunk_tree
* Struck through repros no longer work on HEAD.