CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock cloning inline extent when using flushoncommit

In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and transaction commit when using flushoncommit") a deadlock was fixed between reflinks and transaction commits when the fs is mounted with the flushoncommit option. This happened when we had to copy an inline extent's data to the destination file. However the issue was fixed only for the case where the destination offset is 0, it missed the case when the offset is greater than zero.

Fix this by ensuring we get isize update whenever we copied an inline extent's data into the destination file.

Syzbot reported this with the following trace:

INFO: task kworker/u8:3:57 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:kworker/u8:3 state:D stack:21600 pid:57 tgid:57 ppid:2 taskflags:0x4208160 flags:0x00080000 Workqueue: writeback wbworkfn (flush-btrfs-129) Call Trace: <TASK> contextswitch kernel/sched/core.c:5402 [inline] schedule+0x16f9/0x5500 kernel/sched/core.c:7204 scheduleloop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 waitextentbit fs/btrfs/extent-io-tree.c:905 [inline] btrfslockextentbits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008 btrfslockextent fs/btrfs/extent-io-tree.h:152 [inline] btrfsinvalidatefolio+0x440/0xc00 fs/btrfs/inode.c:7718 extentwritepage fs/btrfs/extentio.c:1848 [inline] extentwritecachepages fs/btrfs/extentio.c:2552 [inline] btrfswritepages+0x12f3/0x2410 fs/btrfs/extentio.c:2684 dowritepages+0x32e/0x550 mm/page-writeback.c:2571 writebacksingleinode+0x133/0x10e0 fs/fs-writeback.c:1764 writebacksbinodes+0x97f/0x1980 fs/fs-writeback.c:2056 wbwriteback+0x445/0xb00 fs/fs-writeback.c:2241 wbdowriteback fs/fs-writeback.c:2388 [inline] wbworkfn+0x3fd/0xf20 fs/fs-writeback.c:2428 processonework+0x98b/0x1630 kernel/workqueue.c:3318 processscheduledworks kernel/workqueue.c:3401 [inline] workerthread+0xb49/0x1140 kernel/workqueue.c:3482 kthread+0x388/0x470 kernel/kthread.c:436 retfromfork+0x514/0xb70 arch/x86/kernel/process.c:158 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 </TASK> INFO: task syz.0.145:8523 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:syz.0.145 state:D stack:22752 pid:8523 tgid:8522 ppid:5850 taskflags:0x400140 flags:0x00080002 Call Trace: <TASK> contextswitch kernel/sched/core.c:5402 [inline] schedule+0x16f9/0x5500 kernel/sched/core.c:7204 scheduleloop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 wbwaitforcompletion+0x3e8/0x790 fs/fs-writeback.c:227 writebackinodessbnr+0x24c/0x2d0 fs/fs-writeback.c:2847 trytowritebackinodessb+0x9a/0xc0 fs/fs-writeback.c:2895 btrfsstartdelallocflush fs/btrfs/transaction.c:2182 [inline] btrfscommittransaction+0x813/0x2fc0 fs/btrfs/transaction.c:2371 btrfssyncfile+0xdf4/0x1230 fs/btrfs/file.c:1822 genericwritesync include/linux/fs.h:2663 [inline] btrfsdowriteiter+0x6a9/0x840 fs/btrfs/file.c:1473 newsyncwrite fs/readwrite.c:595 [inline] vfswrite+0x629/0xba0 fs/readwrite.c:688 ksyswrite+0x156/0x270 fs/readwrite.c:740 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x15f/0x560 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f5a0bdece59 RSP: 002b:00007f5a0b446028 EFLAGS: 00000246 ORIGRAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5a0c065fa0 RCX: 00007f5a0bdece59 RDX: 000000000000029f RSI: 0000200000 ---truncated---