AZL-97289

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix memory leak in btrfsdoencoded_write()

Local fuzzing of 6.12.94 has found the following memory leak:

Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................ backtrace (crc a8a6fc29): kmemleakallocrecursive include/linux/kmemleak.h:42 [inline] slabpostallochook mm/slub.c:4152 [inline] slaballoc_node mm/slub.c:4197 [inline] __kmalloccachenoprof+0x168/0x2c0 mm/slub.c:4358 kmallocnoprof include/linux/slab.h:878 [inline] extentchangesetalloc fs/btrfs/extentio.h:207 [inline] qgroupreservedata+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305 btrfsqgroupreservedata+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfsdoencodedwrite+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfsencodedwrite fs/btrfs/file.c:1482 [inline] btrfsdowriteiter+0x280/0x610 fs/btrfs/file.c:1507 btrfsioctlencodedwrite+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfsioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:906 [inline] __sesysioctl+0xf9/0x170 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/common.c:47 [inline] dosyscall64+0xbe/0x1a0 arch/x86/entry/common.c:78 entrySYSCALL64afterhwframe+0x77/0x7f

Unreferenced object 0xffff888018050a00 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................ 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................ backtrace (crc cb5c9580): kmemleakallocrecursive include/linux/kmemleak.h:42 [inline] slabpostallochook mm/slub.c:4152 [inline] slaballoc_node mm/slub.c:4197 [inline] __kmalloccachenoprof+0x168/0x2c0 mm/slub.c:4358 kmallocnoprof include/linux/slab.h:878 [inline] kzallocnoprof include/linux/slab.h:1014 [inline] ulistprealloc+0x9c/0x110 fs/btrfs/ulist.c:114 extentchangesetprealloc fs/btrfs/extentio.h:217 [inline] __setextentbit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086 set_recordextentbits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821 qgroupreservedata+0x274/0x7d0 fs/btrfs/qgroup.c:4312 btrfsqgroupreservedata+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfsdoencodedwrite+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfsencodedwrite fs/btrfs/file.c:1482 [inline] btrfsdowriteiter+0x280/0x610 fs/btrfs/file.c:1507 btrfsioctlencodedwrite+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfsioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:906 [inline] __sesysioctl+0xf9/0x170 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/common.c:47 [inline] dosyscall64+0xbe/0x1a0 arch/x86/entry/common.c:78 entrySYSCALL64afterhwframe+0x77/0x7f

Fix this by freeing an extent changeset before returning from btrfsdoencoded_write().