Forwarded: [PATCH] xfs: add guard before freeing buffer log item

[syzbot <syzbot+4e6ee73c0ae4b6e8753f@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] xfs: add guard before freeing buffer log item
Author: marcelomspessoto@gmail.com

#syz test: https://github.com/torvalds/linux.git master

A buffer's write completion can race with the CIL walking the same
checkpoint's item list during a forced shutdown's simulated commit
callbacks. Whichever side reaches the item last should be the one to
free it; right now completion frees it unconditionally, so the CIL
walk can end up touching memory that's already gone.

Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
---
 fs/xfs/xfs_buf_item.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index f4c5be67826e..c86c4387f52b 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1072,6 +1072,9 @@ void
 xfs_buf_item_done(
 	struct xfs_buf		*bp)
 {
+	if (atomic_read(&bp->b_log_item->bli_refcount) != 0)
+		return;
+
 	/*
 	 * If we are forcibly shutting down, this may well be off the AIL
 	 * already. That's because we simulate the log-committed callbacks to
-- 
2.55.0