Re: [PATCH] xfs: add guard before freeing buffer log item

[Marcelo Mendes]

I've missed the original discussion about the issue
(https://lore.kernel.org/all/68a70f15.050a0220.3d78fd.0024.GAE@xxxxxxxxxx/T/)
before submitting the fix. I will work on a v2 addressing the root
causes, and this patch can be ignored.

On Fri, Jul 31, 2026 at 3:17 AM Marcelo Mendes Spessoto Junior
<marcelomspessoto@xxxxxxxxx> wrote:
>
> A buffer's write completion can race with the CIL walking the same
> checkpoint's item list during a forced shutdown's simulated commit
> callbacks. Whichever side reaches the item last should be the one to
> free it; right now completion frees it unconditionally, so the CIL
> walk can end up touching memory that's already gone.
>
> Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
> Reported-by: syzbot+4e6ee73c0ae4b6e8753f@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=4e6ee73c0ae4b6e8753f
> Tested-by: syzbot+4e6ee73c0ae4b6e8753f@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@xxxxxxxxx>
> ---
>  fs/xfs/xfs_buf_item.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
> index f4c5be67826e..c86c4387f52b 100644
> --- a/fs/xfs/xfs_buf_item.c
> +++ b/fs/xfs/xfs_buf_item.c
> @@ -1072,6 +1072,9 @@ void
>  xfs_buf_item_done(
>         struct xfs_buf          *bp)
>  {
> +       if (atomic_read(&bp->b_log_item->bli_refcount) != 0)
> +               return;
> +
>         /*
>          * If we are forcibly shutting down, this may well be off the AIL
>          * already. That's because we simulate the log-committed callbacks to
> --
> 2.55.0
>