[PATCH] xfs: add guard before freeing buffer log item

[Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>]

A buffer's write completion can race with the CIL walking the same
checkpoint's item list during a forced shutdown's simulated commit
callbacks. Whichever side reaches the item last should be the one to
free it; right now completion frees it unconditionally, so the CIL
walk can end up touching memory that's already gone.

Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
Reported-by: syzbot+4e6ee73c0ae4b6e8753f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4e6ee73c0ae4b6e8753f
Tested-by: syzbot+4e6ee73c0ae4b6e8753f@syzkaller.appspotmail.com
Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
---
 fs/xfs/xfs_buf_item.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index f4c5be67826e..c86c4387f52b 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1072,6 +1072,9 @@ void
 xfs_buf_item_done(
 	struct xfs_buf		*bp)
 {
+	if (atomic_read(&bp->b_log_item->bli_refcount) != 0)
+		return;
+
 	/*
 	 * If we are forcibly shutting down, this may well be off the AIL
 	 * already. That's because we simulate the log-committed callbacks to
-- 
2.55.0