Re: [PATCH 2/5] xfs: fix racy open zone caching

[Christoph Hellwig <hch@lst.de>]

On Mon, Aug 10, 2026 at 11:21:42AM -0700, Darrick J. Wong wrote:
> > +	if (oz && !atomic_inc_not_zero(&oz->oz_ref))
> > +		oz = NULL;
> 
> Do we still need to test oz for null-ness here?  AFAICT we've already
> handled those cases here.

Yeah, that can go away.

> > +	spin_lock(&ip->i_flags_lock);
> > +	old_oz = VFS_I(ip)->i_private;
> > +	if (old_oz && old_oz->oz_allocated < rtg_blocks(old_oz->oz_rtg))
> > +		swap(oz, old_oz);
> >  	atomic_inc(&oz->oz_ref);
> 
> Hmm, I'm confused about oz_ref handling here.
> 
> If old_oz still has space, we swap oz and old_oz, after which oz alias
> i_private and old_oz is the zone that the caller passed in.  The above
> line then increments oz->oz_ref and puts the zone that the caller passed
> in.
> 
> Doesn't that cause oz->oz_ref to be too high?  We already had a ref
> via i_private, and now we have another one.

The caller needs a reference, and i_private needs a reference.  But this
is a bit to oclever to understand, we probably should be doing
atomic_inc_not_zero for the i_private case as well.  I'll rework this
to be a bit more clear.