From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f47.google.com (mail-qv1-f47.google.com [209.85.219.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BCD8341062 for ; Sun, 2 Aug 2026 23:28:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785713321; cv=none; b=OaBjojHPHC7GO/rd2nS59oGjUWDlKQcau8j7lpMN6U04wU50lDJngc/CczmemfpIaV50m38HPUUsBWm/ScbkMVmlKEOOpK32ILxAKfACY/RwQobGijgIBnrqOyTdbjWhxQLIIGii0hNdtWdELWZvkpVUKVSvzjTE+abjv4z+IeE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785713321; c=relaxed/simple; bh=H1lVJxUhCPfGvC+UgDjNS363K4vk26nMs63+FyWoKGE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=tg1nXO+N8aKWdyIk0f4UUK019E/KU/1xyzCS1YvPgGALDqTSfrVuBEquQaA78sm25RF0Ex98snqj2df/W1DictJ3yfag6wgQ3fFCcvKhrvH2Yhc9LxsvBP39PD/VfCi/kBB6L0kZXtt/H1vZIp8CeIYDRBxCPH/0s/XFkdUnsKU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kKVIZi4+; arc=none smtp.client-ip=209.85.219.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kKVIZi4+" Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-8eeb4508f29so18464536d6.0 for ; Sun, 02 Aug 2026 16:28:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785713319; x=1786318119; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=WtWsszqVORiGbzEMc9bRW/MM4TSHLERgRdJFuPi15b0=; b=kKVIZi4+M3TllcaS1qmc9g4A3LGTI/xfky+DSw8dowpWrrON6MANHTirI/KM98XC5W QYgQC3+neni0VXmvwjwPrOCoqImsQLapAMcUjvtzxM8e7sI1rEL0mgPaMjLZ/cWFU30x eKFgPz7LJ6OIHmvkCm5Dpfo12jJeBP7Qu50LHPIvuLGQbZzXdhDZad2jNjVIy560yfpO U6T5uQj6UFZRLXLjU96Tl0xgczjuH84aXsOwSpRNklepMcIZpeVNpa9pxNeszqaWSCCa vWfApC+qHN6LAoomCA5cznj8pAfF8WCYwfCYwZ047Wv8jLkkJzb/FJ1jRVz+FCAZQTN7 8T2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785713319; x=1786318119; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WtWsszqVORiGbzEMc9bRW/MM4TSHLERgRdJFuPi15b0=; b=TC8fUg0bxLrX36DMePxG0TDSTemXXDKQh7sz5sXn7QAjwH1yWDVohSuIMboVlNtRju z7UeYqjLJAKM0Uk3sXQL0pgghzLZEteWFBaPwPqAwIUN13/7cDVebf4RdFqMuZyv+bdt EPrA1iefdmI9+Y+kFsqB2fD3bzG/4xhcs0fZ0IyGlgw6/pSJnOmF7XpsZXanwfNAfdvp nhAmLH1lZx787eG0FOH4joBqxlCHYr5/ealX3V9OeKHHbAvCbMgf9j/LhUl0W/i7DA6/ C8Lvu5177o9SvbgDV7LxUlpBNYIqEsyUpayl0lE6FwgShTLEHbG6keauRcH+ugPAD5b8 xovQ== X-Forwarded-Encrypted: i=1; AHgh+RpNHQEHuglaL/VKm/kWd32W+dbQ64OD1NJ3wRm9PIDQtG3xf7ZtDn3cL2kqG2GZECGWYfEXs4hifFWfPLo=@vger.kernel.org X-Gm-Message-State: AOJu0YzmRJ2D5XxtoqI54LP33w4XufoZIAPj/mAlTlpNahAML/uUMpYx gAa3sp8n/uB0HemAba6gsDiEKqsYUDlS4rNNYjG6IGSaOxDVYyaXuYBwlCjM0Hql X-Gm-Gg: AR+sD10995/GgxgZoO+yy7vpORZD91XKTK7Zhgkt9Q69QbL0XxhgeHSb36+TNcJbsDZ 1q/zt2sPPlOrAgJk/wtnM04lDgKZLQT/ERPPGjCqPqEp391jigF0P+EvXvD9yiB9uxF9UYOQi0Y cX+5Z6xUtoR+BTlUQBMb/YrwWkiM76y72RG1k0uPUNBCWwWTyA28FSCThkCYgVtq7yrBgeeG5Tz 1XntYVCniNFUuXnCg1RCh1/WgXf1NuF1uNGAAOflmebvcfYTb/HneZdFGKrLr9lDXfKUYVFNKU/ Kr3VhqQJuiV+BolsQdrx5W/ZijnnRZNk3srEC34vy8unDaJwyXuU+FcbyVru1FNg8qBruOYjV0q EdznRgz7mSVJptwhtPa2aYf5nNId+znmgvujeACQTuXayLFKY5QJwSEBZ2j1NosvYnv01zRUNNR epBhOLW1MmcV3bymrWv3URW5fLiCk5kgLuZvnaRNPvQ5tGLXkasfQSVp5NDQV0bGA+94avo55l8 saCwq8OBqnL1w0tF2j2NyGWC3Av X-Received: by 2002:ac8:690e:0:b0:51b:fc67:c73c with SMTP id d75a77b69052e-52b566dbe08mr183487601cf.16.1785713319079; Sun, 02 Aug 2026 16:28:39 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52b4eb6a862sm50621961cf.16.2026.08.02.16.28.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Aug 2026 16:28:38 -0700 (PDT) From: Shuangpeng Bai To: linux-btrfs@vger.kernel.org Cc: clm@fb.com, dsterba@suse.com, naohiro.aota@wdc.com, linux-kernel@vger.kernel.org, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] btrfs: zoned: fix use-after-free in btrfs_reset_unused_block_groups() Date: Sun, 2 Aug 2026 19:28:15 -0400 Message-ID: <20260802232815.3180433-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit btrfs_mark_bg_unused() takes a block group reference when adding it to unused_bgs. btrfs_reset_unused_block_groups() removes a selected block group from the list and immediately drops that reference before accessing bg->physical_map and updating the block group. A concurrent unused block group deletion can then drop the remaining references and free both bg and its physical_map, resulting in a use-after-free. Keep the unused_bgs reference as a local processing reference after removing the block group from the list, and drop it only after the zone reset and block group update have finished. Also release it on the error and read-only paths. Fixes: 453a73c3069a ("btrfs: zoned: reclaim unused zone by zone resetting") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- fs/btrfs/zoned.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c index a016cb471beb..e30b6a61c781 100644 --- a/fs/btrfs/zoned.c +++ b/fs/btrfs/zoned.c @@ -3158,7 +3158,6 @@ int btrfs_reset_unused_block_groups(struct btrfs_space_info *space_info, u64 num } list_del_init(&bg->bg_list); - btrfs_put_block_group(bg); spin_unlock(&fs_info->unused_bgs_lock); /* @@ -3182,6 +3181,7 @@ int btrfs_reset_unused_block_groups(struct btrfs_space_info *space_info, u64 num if (ret) { up_read(&fs_info->dev_replace.rwsem); + btrfs_put_block_group(bg); return ret; } } @@ -3193,6 +3193,7 @@ int btrfs_reset_unused_block_groups(struct btrfs_space_info *space_info, u64 num if (bg->ro) { spin_unlock(&bg->lock); spin_unlock(&space_info->lock); + btrfs_put_block_group(bg); continue; } @@ -3221,6 +3222,7 @@ int btrfs_reset_unused_block_groups(struct btrfs_space_info *space_info, u64 num spin_unlock(&bg->lock); btrfs_return_free_space(space_info, reclaimed); spin_unlock(&space_info->lock); + btrfs_put_block_group(bg); if (num_bytes <= reclaimed) break; -- 2.43.0