CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix invalid pointer dereference in btrfsrundelayedrefs()

In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead(), which can return an error pointer. If the error pointer is -EAGAIN we do a continue and go back to the beginning of the loop, which will not try again to call btrfsselectrefhead() since 'lockedref' is no longer NULL but it's ERRPTR(-EAGAIN), and then we do:

spinlock(&lockedref->lock);

against a ERRPTR(-EAGAIN) value, generating an invalid pointer dereference.

Fix this by ensuring that 'lockedref' is set to NULL when btrfsselectrefhead() returns ERRPTR(-EAGAIN) and incrementing 'count' as well, to prevent infinite looping. We do this by doing a goto to the bottom of the loop that already sets 'lockedref' to NULL and does a condresched(), with an increment to 'count' right before the goto. These measures were in place before the refactoring in commit 0110a4c43451 ("btrfs: refactor btrfsrundelayedrefs loop") but were unintentionally lost afterwards.