Re: [PATCH] xfs: add guard before freeing buffer log item

I've missed the original discussion about the issue
(https://lore.kernel.org/all/[email protected]/T=
/)
before submitting the fix. I will work on a v2 addressing the root
causes, and this patch can be ignored.

On Fri, Jul 31, 2026 at 3:17=E2=80=AFAM Marcelo Mendes Spessoto Junior
<[email protected]> wrote:
>
> A buffer's write completion can race with the CIL walking the same
> checkpoint's item list during a forced shutdown's simulated commit
> callbacks. Whichever side reaches the item last should be the one to
> free it; right now completion frees it unconditionally, so the CIL
> walk can end up touching memory that's already gone.
>
> Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3D4e6ee73c0ae4b6e8753f
> Tested-by: [email protected]
> Signed-off-by: Marcelo Mendes Spessoto Junior <[email protected]=
>
> ---
>  fs/xfs/xfs_buf_item.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
> index f4c5be67826e..c86c4387f52b 100644
> --- a/fs/xfs/xfs_buf_item.c
> +++ b/fs/xfs/xfs_buf_item.c
> @@ -1072,6 +1072,9 @@ void
>  xfs_buf_item_done(
>         struct xfs_buf          *bp)
>  {
> +       if (atomic_read(&bp->b_log_item->bli_refcount) !=3D 0)
> +               return;
> +
>         /*
>          * If we are forcibly shutting down, this may well be off the AIL
>          * already. That's because we simulate the log-committed callback=
s to
> --
> 2.55.0
>