Re: [PATCH RESEND v2] btrfs: fix use-after-free in mark_block_group_to_copy

[David Sterba]

On Mon, Aug 31, 2026 at 01:38:01PM +0800, Hongling Zeng wrote:
> mark_block_group_to_copy() iterates over the commit root with
> skip_locking=true. A concurrent transaction commit can swap and free
> the commit root during iteration, causing use-after-free when
> accessing extent buffers.
> 
> Fix by using path->need_commit_sem to protect the commit root search.
> 
> Fixes: 78ce9fc269af ("btrfs: zoned: mark block groups to copy for device-replace")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>

Added to for-next, with adjusted subject, thanks.