[PATCH] xfs: preserve buffer item with outstanding references

[PATCH] xfs: preserve buffer item with outstanding references

[Eduard Zateev]

The buffer log item can still be referenced by the CIL after the buffer's
synchronous write completes.  In this case xfs_buf_item_relse() is called
from xfs_buf_ioend() with bli_refcount non-zero.  Freeing the item leaves
a stale pointer in the CIL, which xlog_cil_committed() later dereferences.

Restore the reference-count check removed by commit d2fe5c4c8d25
("xfs: rearrange code in xfs_buf_item.c").  If references remain, keep
the log item attached to the buffer so that its final reference release
can perform cleanup.

Build-tested: fs/xfs/xfs_buf_item.o (ARCH=arm64, W=1).
The syzbot report does not include a reproducer, so runtime testing was
not possible.

Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
Reported-by: syzbot+9d8e687768d0f38c1f09@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=9d8e687768d0f38c1f09
Assisted-by: LLM OpenAI Codex

---
 fs/xfs/xfs_buf_item.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 1a4ef34af8d..80f0cf12825 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -80,7 +80,8 @@ xfs_buf_item_relse(
 	trace_xfs_buf_item_relse(bp, _RET_IP_);
 
 	ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags));
-	ASSERT(atomic_read(&bip->bli_refcount) == 0);
+	if (atomic_read(&bip->bli_refcount))
+		return;
 
 	bp->b_log_item = NULL;
 	xfs_buf_rele(bp);

Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>

Re: [PATCH] xfs: preserve buffer item with outstanding references

[Dave Chinner]

On Tue, Oct 20, 2026 at 10:04:31PM +0200, Eduard Zateev wrote:
> The buffer log item can still be referenced by the CIL after the buffer's
> synchronous write completes.  In this case xfs_buf_item_relse() is called
> from xfs_buf_ioend() with bli_refcount non-zero.  Freeing the item leaves
> a stale pointer in the CIL, which xlog_cil_committed() later dereferences.
> 
> Restore the reference-count check removed by commit d2fe5c4c8d25
> ("xfs: rearrange code in xfs_buf_item.c").  If references remain, keep
> the log item attached to the buffer so that its final reference release
> can perform cleanup.
> 
> Build-tested: fs/xfs/xfs_buf_item.o (ARCH=arm64, W=1).
> The syzbot report does not include a reproducer, so runtime testing was
> not possible.
> 
> Fixes: d2fe5c4c8d25 ("xfs: rearrange code in xfs_buf_item.c")
> Reported-by: syzbot+9d8e687768d0f38c1f09@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=9d8e687768d0f38c1f09
> Assisted-by: LLM OpenAI Codex
> 
> ---
>  fs/xfs/xfs_buf_item.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
> index 1a4ef34af8d..80f0cf12825 100644
> --- a/fs/xfs/xfs_buf_item.c
> +++ b/fs/xfs/xfs_buf_item.c
> @@ -80,7 +80,8 @@ xfs_buf_item_relse(
>  	trace_xfs_buf_item_relse(bp, _RET_IP_);
>  
>  	ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags));
> -	ASSERT(atomic_read(&bip->bli_refcount) == 0);
> +	if (atomic_read(&bip->bli_refcount))
> +		return;
>  
>  	bp->b_log_item = NULL;
>  	xfs_buf_rele(bp);
> 
> Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>

You didn't bother to check the mailing list or syzbot for
duplicates or prior discussion, did you?

What I said about this less than two days ago:

https://lore.kernel.org/linux-xfs/atUsQVuCKnAIZc3X@dread/

-Dave.
-- 
Dave Chinner
dgc@kernel.org