{"api_version":"1","generated_at":"2026-08-05T02:22:39+00:00","cve":"CVE-2024-57975","urls":{"html":"https://cve.report/CVE-2024-57975","api":"https://cve.report/api/cve/CVE-2024-57975.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-57975","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-57975"},"summary":{"title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when run_delalloc_nocow() failed\n\n[BUG]\nWith CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash\nwith the following VM_BUG_ON_FOLIO():\n\n  BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28\n  page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664\n  aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"\n  flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)\n  page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n  ------------[ cut here ]------------\n  kernel BUG at mm/page-writeback.c:2992!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : folio_clear_dirty_for_io+0x128/0x258\n  lr : folio_clear_dirty_for_io+0x128/0x258\n  Call trace:\n   folio_clear_dirty_for_io+0x128/0x258\n   btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]\n   __process_folios_contig+0x154/0x268 [btrfs]\n   extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]\n   run_delalloc_nocow+0x5f8/0x760 [btrfs]\n   btrfs_run_delalloc_range+0xa8/0x220 [btrfs]\n   writepage_delalloc+0x230/0x4c8 [btrfs]\n   extent_writepage+0xb8/0x358 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x178/0x3a8 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThe first two lines of extra debug messages show the problem is caused\nby the error handling of run_delalloc_nocow().\n\nE.g. we have the following dirtied range (4K blocksize 4K page size):\n\n    0                 16K                  32K\n    |//////////////////////////////////////|\n    |  Pre-allocated  |\n\nAnd the range [0, 16K) has a preallocated extent.\n\n- Enter run_delalloc_nocow() for range [0, 16K)\n  Which found range [0, 16K) is preallocated, can do the proper NOCOW\n  write.\n\n- Enter fallback_to_fow() for range [16K, 32K)\n  Since the range [16K, 32K) is not backed by preallocated extent, we\n  have to go COW.\n\n- cow_file_range() failed for range [16K, 32K)\n  So cow_file_range() will do the clean up by clearing folio dirty,\n  unlock the folios.\n\n  Now the folios in range [16K, 32K) is unlocked.\n\n- Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()\n  Which is called with PAGE_START_WRITEBACK to start page writeback.\n  But folios can only be marked writeback when it's properly locked,\n  thus this triggered the VM_BUG_ON_FOLIO().\n\nFurthermore there is another hidden but common bug that\nrun_delalloc_nocow() is not clearing the folio dirty flags in its error\nhandling path.\nThis is the common bug shared between run_delalloc_nocow() and\ncow_file_range().\n\n[FIX]\n- Clear folio dirty for range [@start, @cur_offset)\n  Introduce a helper, cleanup_dirty_folios(), which\n  will find and lock the folio in the range, clear the dirty flag and\n  start/end the writeback, with the extra handling for the\n  @locked_folio.\n\n- Introduce a helper to clear folio dirty, start and end writeback\n\n- Introduce a helper to record the last failed COW range end\n  This is to trace which range we should skip, to avoid double\n  unlocking.\n\n- Skip the failed COW range for the e\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2025-02-27 02:15:10","updated_at":"2026-08-04 11:22:33"},"problem_types":["CWE-459"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/5ae72abbf91eb172ce3a838a4dc34be3c9707296","name":"https://git.kernel.org/stable/c/5ae72abbf91eb172ce3a838a4dc34be3c9707296","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","name":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2434533f1c963e7317c45880c98287e5bed98325","name":"https://git.kernel.org/stable/c/2434533f1c963e7317c45880c98287e5bed98325","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-57975","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57975","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 17ca04aff7e6171df684b7b65804df8830eb8c15 5ae72abbf91eb172ce3a838a4dc34be3c9707296 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 17ca04aff7e6171df684b7b65804df8830eb8c15 2434533f1c963e7317c45880c98287e5bed98325 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 17ca04aff7e6171df684b7b65804df8830eb8c15 c2b47df81c8e20a8e8cd94f0d7df211137ae94ed git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.13 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13.2 6.13.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"57975","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/inode.c","fs/btrfs/subpage.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ae72abbf91eb172ce3a838a4dc34be3c9707296","status":"affected","version":"17ca04aff7e6171df684b7b65804df8830eb8c15","versionType":"git"},{"lessThan":"2434533f1c963e7317c45880c98287e5bed98325","status":"affected","version":"17ca04aff7e6171df684b7b65804df8830eb8c15","versionType":"git"},{"lessThan":"c2b47df81c8e20a8e8cd94f0d7df211137ae94ed","status":"affected","version":"17ca04aff7e6171df684b7b65804df8830eb8c15","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/inode.c","fs/btrfs/subpage.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.5"},{"lessThan":"3.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.13","versionType":"semver"},{"lessThanOrEqual":"6.13.*","status":"unaffected","version":"6.13.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.14","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.13","versionStartIncluding":"3.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.2","versionStartIncluding":"3.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14","versionStartIncluding":"3.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when run_delalloc_nocow() failed\n\n[BUG]\nWith CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash\nwith the following VM_BUG_ON_FOLIO():\n\n  BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28\n  page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664\n  aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"\n  flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)\n  page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n  ------------[ cut here ]------------\n  kernel BUG at mm/page-writeback.c:2992!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : folio_clear_dirty_for_io+0x128/0x258\n  lr : folio_clear_dirty_for_io+0x128/0x258\n  Call trace:\n   folio_clear_dirty_for_io+0x128/0x258\n   btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]\n   __process_folios_contig+0x154/0x268 [btrfs]\n   extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]\n   run_delalloc_nocow+0x5f8/0x760 [btrfs]\n   btrfs_run_delalloc_range+0xa8/0x220 [btrfs]\n   writepage_delalloc+0x230/0x4c8 [btrfs]\n   extent_writepage+0xb8/0x358 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x178/0x3a8 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThe first two lines of extra debug messages show the problem is caused\nby the error handling of run_delalloc_nocow().\n\nE.g. we have the following dirtied range (4K blocksize 4K page size):\n\n    0                 16K                  32K\n    |//////////////////////////////////////|\n    |  Pre-allocated  |\n\nAnd the range [0, 16K) has a preallocated extent.\n\n- Enter run_delalloc_nocow() for range [0, 16K)\n  Which found range [0, 16K) is preallocated, can do the proper NOCOW\n  write.\n\n- Enter fallback_to_fow() for range [16K, 32K)\n  Since the range [16K, 32K) is not backed by preallocated extent, we\n  have to go COW.\n\n- cow_file_range() failed for range [16K, 32K)\n  So cow_file_range() will do the clean up by clearing folio dirty,\n  unlock the folios.\n\n  Now the folios in range [16K, 32K) is unlocked.\n\n- Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()\n  Which is called with PAGE_START_WRITEBACK to start page writeback.\n  But folios can only be marked writeback when it's properly locked,\n  thus this triggered the VM_BUG_ON_FOLIO().\n\nFurthermore there is another hidden but common bug that\nrun_delalloc_nocow() is not clearing the folio dirty flags in its error\nhandling path.\nThis is the common bug shared between run_delalloc_nocow() and\ncow_file_range().\n\n[FIX]\n- Clear folio dirty for range [@start, @cur_offset)\n  Introduce a helper, cleanup_dirty_folios(), which\n  will find and lock the folio in the range, clear the dirty flag and\n  start/end the writeback, with the extra handling for the\n  @locked_folio.\n\n- Introduce a helper to clear folio dirty, start and end writeback\n\n- Introduce a helper to record the last failed COW range end\n  This is to trace which range we should skip, to avoid double\n  unlocking.\n\n- Skip the failed COW range for the e\n---truncated---"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:41:28.118Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5ae72abbf91eb172ce3a838a4dc34be3c9707296"},{"url":"https://git.kernel.org/stable/c/2434533f1c963e7317c45880c98287e5bed98325"},{"url":"https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed"}],"title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-57975","datePublished":"2025-02-27T02:07:03.586Z","dateReserved":"2025-02-27T02:04:28.912Z","dateUpdated":"2026-08-04T09:41:28.118Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-02-27 02:15:10","lastModifiedDate":"2026-08-04 11:22:33","problem_types":["CWE-459"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.13","matchCriteriaId":"F4AD16DC-627B-4DDF-9FEE-C7ABEC63B62B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.13.2","matchCriteriaId":"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"57975","Ordinal":"1","Title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed","CVE":"CVE-2024-57975","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"57975","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when run_delalloc_nocow() failed\n\n[BUG]\nWith CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash\nwith the following VM_BUG_ON_FOLIO():\n\n  BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28\n  page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664\n  aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"\n  flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)\n  page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n  ------------[ cut here ]------------\n  kernel BUG at mm/page-writeback.c:2992!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : folio_clear_dirty_for_io+0x128/0x258\n  lr : folio_clear_dirty_for_io+0x128/0x258\n  Call trace:\n   folio_clear_dirty_for_io+0x128/0x258\n   btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]\n   __process_folios_contig+0x154/0x268 [btrfs]\n   extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]\n   run_delalloc_nocow+0x5f8/0x760 [btrfs]\n   btrfs_run_delalloc_range+0xa8/0x220 [btrfs]\n   writepage_delalloc+0x230/0x4c8 [btrfs]\n   extent_writepage+0xb8/0x358 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x178/0x3a8 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThe first two lines of extra debug messages show the problem is caused\nby the error handling of run_delalloc_nocow().\n\nE.g. we have the following dirtied range (4K blocksize 4K page size):\n\n    0                 16K                  32K\n    |//////////////////////////////////////|\n    |  Pre-allocated  |\n\nAnd the range [0, 16K) has a preallocated extent.\n\n- Enter run_delalloc_nocow() for range [0, 16K)\n  Which found range [0, 16K) is preallocated, can do the proper NOCOW\n  write.\n\n- Enter fallback_to_fow() for range [16K, 32K)\n  Since the range [16K, 32K) is not backed by preallocated extent, we\n  have to go COW.\n\n- cow_file_range() failed for range [16K, 32K)\n  So cow_file_range() will do the clean up by clearing folio dirty,\n  unlock the folios.\n\n  Now the folios in range [16K, 32K) is unlocked.\n\n- Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()\n  Which is called with PAGE_START_WRITEBACK to start page writeback.\n  But folios can only be marked writeback when it's properly locked,\n  thus this triggered the VM_BUG_ON_FOLIO().\n\nFurthermore there is another hidden but common bug that\nrun_delalloc_nocow() is not clearing the folio dirty flags in its error\nhandling path.\nThis is the common bug shared between run_delalloc_nocow() and\ncow_file_range().\n\n[FIX]\n- Clear folio dirty for range [@start, @cur_offset)\n  Introduce a helper, cleanup_dirty_folios(), which\n  will find and lock the folio in the range, clear the dirty flag and\n  start/end the writeback, with the extra handling for the\n  @locked_folio.\n\n- Introduce a helper to clear folio dirty, start and end writeback\n\n- Introduce a helper to record the last failed COW range end\n  This is to trace which range we should skip, to avoid double\n  unlocking.\n\n- Skip the failed COW range for the e\n---truncated---","Type":"Description","Title":"btrfs: do proper folio cleanup when run_delalloc_nocow() failed"}]}}}