Re: [syzbot] [xfs?] KASAN: slab-use-after-free Write in xlog_cil_ail_insert

[Jeffin Philip]

On Wed, Sep 09, 2026, Dave Chinner wrote:

>The short term fix is to slap a bandaid on xfs_buf_submit() to wait
>for unpin before erroring out a pinned buffer on shutdown. That,
>however, doesn't fix the underlying lack of full lifecycle reference
>counts for log items.
>
>The long term fix is have the AIL require a reference count to be
>held on log items it tracks, and only have that refcount removed
>when the item is removed from the AIL. That's a much bigger rework
>of the code. 
>
>FYI, I've attached two document below - the design for
>generic full lifecycle log item reference counting, and the design
>for converting the inode log item to be dynamic similar to the buf
>log item so we don't end up with millions of ILIs that are never
>used left sitting around in memory until it's owner inode is
>reclaimed.

I read the documents and have started writing the wrappers. Is anyone
else working on it?

Thanks,
Jeffin.