[PATCH] xfs: preserve buffer item with outstanding references

[Eduard Zateev <hackerowskiy@gmail.com>]

The buffer log item can still be referenced by the CIL after the buffer's
synchronous write completes.  In this case xfs_buf_item_relse() is called
from xfs_buf_ioend() with bli_refcount non-zero.  Freeing the item leaves
a stale pointer in the CIL, which xlog_cil_committed() later dereferences.

Restore the reference-count check removed by commit d2fe5c4c8d25
("xfs: rearrange code in xfs_buf_item.c").  If references remain, keep
the log item attached to the buffer so that its final reference release
can perform cleanup.

Build-tested: fs/xfs/xfs_buf_item.o (ARCH=arm64, W=1).
The syzbot report does not include a reproducer, so runtime testing was
not possible.

Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
Reported-by: syzbot+9d8e687768d0f38c1f09@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=9d8e687768d0f38c1f09
Assisted-by: LLM OpenAI Codex

---
 fs/xfs/xfs_buf_item.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 1a4ef34af8d..80f0cf12825 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -80,7 +80,8 @@ xfs_buf_item_relse(
 	trace_xfs_buf_item_relse(bp, _RET_IP_);
 
 	ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags));
-	ASSERT(atomic_read(&bip->bli_refcount) == 0);
+	if (atomic_read(&bip->bli_refcount))
+		return;
 
 	bp->b_log_item = NULL;
 	xfs_buf_rele(bp);

Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>