Re: [PATCH 2/4] btrfs: zoned: fix possible UAF in wait_eb_writebacks

[Johannes Thumshirn <johannes.thumshirn@wdc.com>]

On Mon, Sep 14, 2026 at 05:05:03PM +0200, David Sterba wrote:
> On Mon, Sep 14, 2026 at 10:52:46AM +0200, Johannes Thumshirn wrote:
> > wait_eb_writebacks() iterates the fs_info->buffer_tree xarray and waits
> > for the writeback of these extent-buffers. Waiting for writeback needs
> > to be done without the rcu_read_lock() held (because it can sleep) and
> > thus the loop drops the rcu_read_lock() before calling into
> > wait_on_extent_buffer_writeback(). But extent_buffers are freed through
> > RCU, so if btrfs_release_extent_buffer_rcu() is scheduled while we're
> > still waiting on the writeback, the extent_buffer will be freed causing
> > a use-after-free.
> > 
> > Similar to what is done in find_extent_buffer_nolock(), get a reference
> > to the extent_buffer before calling into
> > wait_on_extent_buffer_writeback() so a sucessfull writeback does not
> > free the extent_buffer while we still have a reference to it.
> > 
> > Fixes: 2dd7e7bc0282 ("btrfs: zoned: wait for extent buffer IOs before finishing a zone")
> > Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
> > ---
> >  fs/btrfs/zoned.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
> > index 12391063304b..c09e32904caf 100644
> > --- a/fs/btrfs/zoned.c
> > +++ b/fs/btrfs/zoned.c
> > @@ -2511,8 +2511,11 @@ static void wait_eb_writebacks(struct btrfs_block_group *block_group)
> >  			continue;
> >  		if (eb->start >= end)
> >  			break;
> > +		if (!refcount_inc_not_zero(&eb->refs))
> 
> Please add a comment with the reason for that, several other uses of
> inc-not-zero also have it. It makes it more visible and noticeable, also
> a disappearing eb during some operation is disasterous.
> 
> Unrelated to this patch, the LLM reviews take the comments into account
> and sometimes point out a pattern that is not followed in some case. It
> can be either valid or a false positive, we can verify that. For humans
> reading the code it's also useful as a drive-by knowledge.

Done.