Re: [bug report] xfs: fix racy open zone caching

[Christoph Hellwig <hch@lst.de>]

On Mon, Sep 14, 2026 at 02:54:53PM +0300, Dan Carpenter wrote:
> 	fs/xfs/xfs_zone_alloc.c:823 xfs_get_cached_zone()
> 	error: we previously assumed 'oz' could be null (see line 813)

The warning is correct.  I actually ran into it this weekend while
running benchmarks and sent a fix just a few minutes ago...

>     809          */
>     810         if (oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
>     811                 spin_lock(&ip->i_flags_lock);
>     812                 oz = VFS_I(ip)->i_private;
>     813                 if (oz && oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
>                             ^^
> imagine oz is NULL
> 
>     814                         VFS_I(ip)->i_private = NULL;
>     815                         spin_unlock(&ip->i_flags_lock);
>     816                         xfs_open_zone_put(oz);
>     817                         oz = NULL;
>     818                         goto out_unlock;
>     819                 }
>     820                 spin_unlock(&ip->i_flags_lock);
>     821         }
>     822 
> --> 823         if (!atomic_inc_not_zero(&oz->oz_ref))
>                                           ^^
> then this will crash
> 
>     824                 oz = NULL;
>     825 out_unlock:
>     826         rcu_read_unlock();
>     827         return oz;
>     828 }
> 
> This email is a free service from the Smatch-CI project [smatch.sf.net].
> 
> regards,
> dan carpenter
---end quoted text---