[PATCH v2] btrfs: zoned: reset active_meta_bg on zone finish

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE and removes the
block group from zone_active_bgs, but only the pivot path in
check_bg_is_active() resets fs_info->active_meta_bg / active_system_bg.
Any other finish path (the async zone-finish endio work,
btrfs_zone_finish(), reclaim) then leaves active_meta_bg / active_system_bg
pointing at an inactive, fully written block group.

Reset the corresponding active_{meta,system}_bg pointer in do_zone_finish()
so it can never go stale.

Fixes: 13bb483d32ab ("btrfs: zoned: activate metadata block group on write time")
Cc: [email protected]
Signed-off-by: Johannes Thumshirn <[email protected]>
---
Changes to v1:
- Get reference to block-group before calling check_bg_is_active() to
  avoid possible UAF (sashiko).

 fs/btrfs/zoned.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index 97f06dd01693..70997470fa84 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -2270,6 +2270,7 @@ int btrfs_check_meta_write_pointer(struct btrfs_fs_info *fs_info,
 
 	if (block_group->meta_write_pointer == eb->start) {
 		struct btrfs_block_group **tgt;
+		bool active;
 
 		if (!test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &fs_info->flags))
 			return 0;
@@ -2278,7 +2279,12 @@ int btrfs_check_meta_write_pointer(struct btrfs_fs_info *fs_info,
 			tgt = &fs_info->active_system_bg;
 		else
 			tgt = &fs_info->active_meta_bg;
-		if (check_bg_is_active(ctx, tgt))
+
+		btrfs_get_block_group(*tgt);
+		active = check_bg_is_active(ctx, tgt);
+		btrfs_put_block_group(*tgt);
+
+		if (active)
 			return 0;
 	}
 
@@ -2535,6 +2541,7 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ
 	const bool is_metadata = (block_group->flags &
 			(BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM));
 	struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
+	struct btrfs_block_group **active_bg = NULL;
 	int ret = 0;
 	int i;
 
@@ -2632,6 +2639,20 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ
 	/* For active_bg_list */
 	btrfs_put_block_group(block_group);
 
+	if (block_group->flags & BTRFS_BLOCK_GROUP_SYSTEM)
+		active_bg = &fs_info->active_system_bg;
+	else if (block_group->flags & BTRFS_BLOCK_GROUP_METADATA)
+		active_bg = &fs_info->active_meta_bg;
+
+	if (active_bg) {
+		btrfs_zoned_meta_io_lock(fs_info);
+		if (*active_bg == block_group) {
+			btrfs_put_block_group(block_group);
+			*active_bg = NULL;
+		}
+		btrfs_zoned_meta_io_unlock(fs_info);
+	}
+
 	clear_and_wake_up_bit(BTRFS_FS_NEED_ZONE_FINISH, &fs_info->flags);
 
 	return 0;
-- 
2.54.0