btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

mark_block_group_to_copy() iterates over the commit root with
skip_locking=true. A concurrent transaction commit can swap and free
the commit root during iteration, causing use-after-free when
accessing extent buffers.

Fix it by using path->need_commit_sem to protect the commit root search.

Fixes: 78ce9fc269af ("btrfs: zoned: mark block groups to copy for device-replace")
CC: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 22eea188a328081ec21a2422feeea200624e5601..cdfe093e5c5c4fdd7bdd67a853e3cd632c6b1b6b 100644 (file)
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -498,6 +498,7 @@ static int mark_block_group_to_copy(struct btrfs_fs_info *fs_info,
        path->reada = READA_FORWARD;
        path->search_commit_root = true;
        path->skip_locking = true;
+       path->need_commit_sem = true;
 
        key.objectid = src_dev->devid;
        key.type = BTRFS_DEV_EXTENT_KEY;