On Tue, Apr 21, 2020 at 07:08:26PM -0700, Darrick J. Wong wrote: > From: Darrick J. Wong <darrick.wong@xxxxxxxxxx> > > Make it so that the deferred operations freezer can save inode numbers > when we freeze the dfops chain, and turn them into pointers to incore > inodes when we thaw the dfops chain to finish them. Next, add dfops > item freeze and thaw functions to the BUI/BUD items so that they can > take advantage of this new feature. This fixes a UAF bug in the > deferred bunmapi code because xfs_bui_recover can schedule another BUI > to continue unmapping but drops the inode pointer immediately > afterwards. I'm only looking over this the first time, but why can't we just keep inode reference around during reocvery instead of this fairly complicated scheme to save the ino and then look it up again?
