[PATCH v4 0/4] xfs: fix AIL push use-after-free during shutdown

[Yuto Ohnuki]

When a filesystem is shut down, background inode reclaim and the xfsaild
can race to abort and free dirty inodes. Since commit 90c60e164012
("xfs: xfs_iflush() is no longer necessary"), xfs_inode_item_push() no
longer holds ILOCK_SHARED while flushing, removing the protection that
prevented the inode from being reclaimed during the flush.

This results in use-after-free when dereferencing log items after
iop_push() returns, or when reacquiring the AIL lock via lip->li_ailp.

This series fixes the issue by:
1. Reordering unmount to stop reclaim and inodegc before pushing the AIL
2. Capturing log item fields before push callbacks for tracepoints
3. Saving the ailp pointer before dropping the AIL lock
4. Factoring the push loop into a helper for readability (non-bugfix)

Changes in v4:
- Fixed unmount ordering: xfs_inodegc_stop before cancel_delayed_work_sync
  to prevent inodegc from re-queuing m_reclaim_work as suggested by
  Darrick J. Wong
- Updated xfs_unmount_flush_inodes function comment to reflect new ordering
- Reworked patch ordering so bugfix patches (1-3) do not depend on the
  refactoring patch, reducing stable backport burden
- Added comment at xfsaild_push_item call site documenting that the log
  item must not be dereferenced after the call
- Moved refactoring to patch 4 without Cc: stable
- Link to v3: https://lore.kernel.org/all/20260308182804.33127-6-ytohnuki@xxxxxxxxxx/

Changes in v3:
- Split into 4 patches as suggested by Dave Chinner
- Moved UAF-unsafe point comments to after xfs_buf_relse()
- Passed ailp instead of dev to tracepoints
- Moved xfs_ail_push_class definition after xfs_log_item_class events
- Factored xfsaild_push() loop body into xfsaild_process_logitem()
- Added xfsaild_push_item() header comment describing post-return lifetime
- Link to v2: https://lore.kernel.org/all/20260305185836.56478-2-ytohnuki@xxxxxxxxxx/

Changes in v2:
- Reordered xfs_unmount_flush_inodes() to stop reclaim before pushing
  AIL suggested by Dave Chinner
- Introduced xfs_ail_push_class trace event to avoid dereferencing
  freed log items in tracepoints
- Added comments documenting that log items must not be referenced
  after iop_push() returns
- Saved ailp pointer in local variables in push functions
- Link to v1: https://lore.kernel.org/all/20260304162405.58017-2-ytohnuki@xxxxxxxxxx/

Yuto Ohnuki (4):
  xfs: stop reclaim before pushing AIL during unmount
  xfs: avoid dereferencing log items after push callbacks
  xfs: save ailp before dropping the AIL lock in push callbacks
  xfs: refactor xfsaild_push loop into helper

 fs/xfs/xfs_dquot_item.c |   9 ++-
 fs/xfs/xfs_inode_item.c |   9 ++-
 fs/xfs/xfs_mount.c      |   7 ++-
 fs/xfs/xfs_trace.h      |  36 ++++++++++--
 fs/xfs/xfs_trans_ail.c  | 127 ++++++++++++++++++++++++----------------
 5 files changed, 125 insertions(+), 63 deletions(-)

-- 
2.50.1




Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284

Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705