xfs: use reference counts to free clean buffer items
authorDave Chinner <dchinner@redhat.com>
Mon, 12 Aug 2013 10:50:11 +0000 (20:50 +1000)
committerBen Myers <bpm@sgi.com>
Thu, 15 Aug 2013 21:42:29 +0000 (16:42 -0500)
commit2ad01f53dc34ef3180e555d40b331f95f269a0fa
tree49729386fa5b0d6e7cf743e768b4e8170713b26a
parentd6970d4b726cea6d7a9bc4120814f95c09571fc3
xfs: use reference counts to free clean buffer items

When a transaction is cancelled and the buffer log item is clean in
the transaction, the buffer log item is unconditionally freed. If
the log item is in the AIL, however, this leads to a use after free
condition as the item still has other users.

In this case, xfs_buf_item_relse() should only be called on clean
buffer items if the reference count has dropped to zero. This
ensures only the last user frees the item.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
fs/xfs/xfs_buf_item.c