free_watch() is missing a kfree() to actually free the watch. #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git c82efd1dfb229d6aa7e08d57d1c41f034d97b1eb