[bug report] xfs: fix racy open zone caching

[bug report] xfs: fix racy open zone caching

[Dan Carpenter]

Hello Christoph Hellwig,

Commit 2d829cc76777 ("xfs: fix racy open zone caching") from Aug 11,
2026 (linux-next), leads to the following Smatch static checker
warning:

	fs/xfs/xfs_zone_alloc.c:823 xfs_get_cached_zone()
	error: we previously assumed 'oz' could be null (see line 813)

fs/xfs/xfs_zone_alloc.c
    790 static struct xfs_open_zone *
    791 xfs_get_cached_zone(
    792         struct xfs_inode        *ip)
    793 {
    794         struct xfs_open_zone        *oz;
    795 
    796         rcu_read_lock();
    797         oz = VFS_I(ip)->i_private;
    798         if (!oz)
    799                 goto out_unlock;
    800 
    801         /*
    802          * GC only steals open zones at mount time, so no GC zones should end up
    803          * in the cache.
    804          */
    805         ASSERT(!oz->oz_is_gc);
    806 
    807         /*
    808          * Drop the old cached open zone if it is full.
    809          */
    810         if (oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
    811                 spin_lock(&ip->i_flags_lock);
    812                 oz = VFS_I(ip)->i_private;
    813                 if (oz && oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
                            ^^
imagine oz is NULL

    814                         VFS_I(ip)->i_private = NULL;
    815                         spin_unlock(&ip->i_flags_lock);
    816                         xfs_open_zone_put(oz);
    817                         oz = NULL;
    818                         goto out_unlock;
    819                 }
    820                 spin_unlock(&ip->i_flags_lock);
    821         }
    822 
--> 823         if (!atomic_inc_not_zero(&oz->oz_ref))
                                          ^^
then this will crash

    824                 oz = NULL;
    825 out_unlock:
    826         rcu_read_unlock();
    827         return oz;
    828 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter

Re: [bug report] xfs: fix racy open zone caching

[Christoph Hellwig]

On Mon, Sep 14, 2026 at 02:54:53PM +0300, Dan Carpenter wrote:
> 	fs/xfs/xfs_zone_alloc.c:823 xfs_get_cached_zone()
> 	error: we previously assumed 'oz' could be null (see line 813)

The warning is correct.  I actually ran into it this weekend while
running benchmarks and sent a fix just a few minutes ago...

>     809          */
>     810         if (oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
>     811                 spin_lock(&ip->i_flags_lock);
>     812                 oz = VFS_I(ip)->i_private;
>     813                 if (oz && oz->oz_allocated == rtg_blocks(oz->oz_rtg)) {
>                             ^^
> imagine oz is NULL
> 
>     814                         VFS_I(ip)->i_private = NULL;
>     815                         spin_unlock(&ip->i_flags_lock);
>     816                         xfs_open_zone_put(oz);
>     817                         oz = NULL;
>     818                         goto out_unlock;
>     819                 }
>     820                 spin_unlock(&ip->i_flags_lock);
>     821         }
>     822 
> --> 823         if (!atomic_inc_not_zero(&oz->oz_ref))
>                                           ^^
> then this will crash
> 
>     824                 oz = NULL;
>     825 out_unlock:
>     826         rcu_read_unlock();
>     827         return oz;
>     828 }
> 
> This email is a free service from the Smatch-CI project [smatch.sf.net].
> 
> regards,
> dan carpenter
---end quoted text---