[PATCH] btrfs: fix missing folio_unlock in read_merkle_tree_page error path

[PATCH] btrfs: fix missing folio_unlock in read_merkle_tree_page error path

[Hongling Zeng]

filemap_add_folio() adds the folio to the page cache and leaves it locked.
If read_key_bytes() fails, the error path only calls folio_put() without
first unlocking the folio, leaving it permanently locked in the page cache.
This causes subsequent attempts to lock this folio to hang.

Fix by adding folio_unlock() before folio_put() in the error handling path.

Fixes: 06ed09351b67 ("btrfs: convert btrfs_read_merkle_tree_page() to use a folio")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 fs/btrfs/verity.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/verity.c b/fs/btrfs/verity.c
index 983365a73541..4431656140f8 100644
--- a/fs/btrfs/verity.c
+++ b/fs/btrfs/verity.c
@@ -753,6 +753,7 @@ static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
 	ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
 			     folio_address(folio), PAGE_SIZE, folio);
 	if (ret < 0) {
+		folio_unlock(folio);
 		folio_put(folio);
 		return ERR_PTR(ret);
 	}
-- 
2.25.1

Re: [PATCH] btrfs: fix missing folio_unlock in read_merkle_tree_page error path

[Qu Wenruo]

在 2026/8/17 15:06, Hongling Zeng 写道:
> filemap_add_folio() adds the folio to the page cache and leaves it locked.
> If read_key_bytes() fails, the error path only calls folio_put() without
> first unlocking the folio, leaving it permanently locked in the page cache.
> This causes subsequent attempts to lock this folio to hang.
> 
> Fix by adding folio_unlock() before folio_put() in the error handling path.
> 
> Fixes: 06ed09351b67 ("btrfs: convert btrfs_read_merkle_tree_page() to use a folio")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>

A fix is already submitted and merged:

https://lore.kernel.org/linux-btrfs/20260722025435.1493093-1-chenyichong@uniontech.com/

Next time let your agent to read the btrfs developer's note and check if 
there is already a fix:

https://btrfs.readthedocs.io/en/latest/dev/Developer-s-FAQ.html#development-phase-linux-next-for-next

> ---
>   fs/btrfs/verity.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/fs/btrfs/verity.c b/fs/btrfs/verity.c
> index 983365a73541..4431656140f8 100644
> --- a/fs/btrfs/verity.c
> +++ b/fs/btrfs/verity.c
> @@ -753,6 +753,7 @@ static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
>   	ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
>   			     folio_address(folio), PAGE_SIZE, folio);
>   	if (ret < 0) {
> +		folio_unlock(folio);
>   		folio_put(folio);
>   		return ERR_PTR(ret);
>   	}

Re: [PATCH] btrfs: fix missing folio_unlock in read_merkle_tree_page error path

[Hongling Zeng]

在 2026年08月17日 14:43, Qu Wenruo 写道:
>
>
> 在 2026/8/17 15:06, Hongling Zeng 写道:
>> filemap_add_folio() adds the folio to the page cache and leaves it 
>> locked.
>> If read_key_bytes() fails, the error path only calls folio_put() without
>> first unlocking the folio, leaving it permanently locked in the page 
>> cache.
>> This causes subsequent attempts to lock this folio to hang.
>>
>> Fix by adding folio_unlock() before folio_put() in the error handling 
>> path.
>>
>> Fixes: 06ed09351b67 ("btrfs: convert btrfs_read_merkle_tree_page() to 
>> use a folio")
>> Cc: stable@vger.kernel.org
>> Assisted-by: Codex:gpt-5.5
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
>
> A fix is already submitted and merged:
>
> https://lore.kernel.org/linux-btrfs/20260722025435.1493093-1-chenyichong@uniontech.com/ 
>
>
> Next time let your agent to read the btrfs developer's note and check 
> if there is already a fix:
>
> https://btrfs.readthedocs.io/en/latest/dev/Developer-s-FAQ.html#development-phase-linux-next-for-next 
>
>
   Thanks for the feedback.

   I should have checked for existing fixes first.

   I will ensure to check git history and mailing lists before submitting
   future patches.

   Apologies for the duplicate submission.
>> ---
>>   fs/btrfs/verity.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/fs/btrfs/verity.c b/fs/btrfs/verity.c
>> index 983365a73541..4431656140f8 100644
>> --- a/fs/btrfs/verity.c
>> +++ b/fs/btrfs/verity.c
>> @@ -753,6 +753,7 @@ static struct page 
>> *btrfs_read_merkle_tree_page(struct inode *inode,
>>       ret = read_key_bytes(BTRFS_I(inode), 
>> BTRFS_VERITY_MERKLE_ITEM_KEY, off,
>>                    folio_address(folio), PAGE_SIZE, folio);
>>       if (ret < 0) {
>> +        folio_unlock(folio);
>>           folio_put(folio);
>>           return ERR_PTR(ret);
>>       }