[PATCH 0/2] block: two fixes for the zone report ioctls

[PATCH 0/2] block: two fixes for the zone report ioctls

[Shashank Mohan Jain]

Two problems in the zone report code added in v6.19:

 - BLKREPORTZONEV2 does not look at BLK_ZONE_REP_CACHED and returns the
   cached report also when the flag is not set (patch 1).

 - blkdev_get_zone_info() gives a smaller last zone the length of a
   full zone, so the cached report describes a zone that ends behind
   the end of the device (patch 2).

Both were found by reading the code and then confirmed with zoned
null_blk devices in qemu (x86_64). The test program opens one zone
explicitly, writes to a second zone and closes it, and compares the
reports of BLKREPORTZONE, BLKREPORTZONEV2 with flags 0 and
BLKREPORTZONEV2 with BLK_ZONE_REP_CACHED. On mainline it finds both
problems. With patch 1 only the length of the last zone in the cached
report is left, and with both patches there is no difference apart
from the zone conditions and the write pointer of conventional zones
in the cached report, which are as documented.

For patch 1 there is a choice between the code and the documentation.
The changelog of b30ffcdc0c15 and the comments in the uapi header both
say that without BLK_ZONE_REP_CACHED the report comes from the device,
and BLKREPORTZONE is marked as deprecated in favour of the new ioctl,
so I changed the code. If the cached report is meant to be the only
mode of BLKREPORTZONEV2, the header needs to say so instead.

The series is based on mainline (a5ebb76233b7, v7.3-rc6+). Patch 1
applies to next-20261009 as is. Patch 2 needs its context adjusted
there, because blkdev_get_zone_info() tests the zone type instead of
the zone condition in for-7.4/block.

Shashank Mohan Jain (2):
  block: only use the cached zone report if BLK_ZONE_REP_CACHED is set
  block: fix the length of a smaller last zone in blkdev_get_zone_info()

 block/blk-zoned.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)


base-commit: a5ebb76233b79db01e82e061173cb73c6d2b5c6b
-- 
2.43.0

[PATCH 1/2] block: only use the cached zone report if BLK_ZONE_REP_CACHED is set

[Shashank Mohan Jain]

BLKREPORTZONEV2 takes the flags field of struct blk_zone_report as an
input. With BLK_ZONE_REP_CACHED the report is built from the zone
information cached by the block layer. Without it, BLKREPORTZONEV2 is
documented to behave like BLKREPORTZONE and to get the report from the
device: this is what the changelog of the commit that added the ioctl
and the comments in include/uapi/linux/blkzoned.h say.

blkdev_report_zones_ioctl() only uses the flag to validate the input
and calls blkdev_report_zones_cached() for every BLKREPORTZONEV2
request. A caller that passes flags == 0 gets the cached report, in
which implicitly open, explicitly open and closed zones all have the
condition BLK_ZONE_COND_ACTIVE, and an explicitly opened empty zone is
reported as empty.

Example with a zoned null_blk device (10 MiB, 4 MiB zones) after
BLKOPENZONE on zone 0, and a write of 8 sectors to zone 1 followed by
BLKCLOSEZONE:

  BLKREPORTZONE:             zone 0 cond 0x3 (EXP_OPEN)
                             zone 1 cond 0x4 (CLOSED)
  BLKREPORTZONEV2, flags 0:  zone 0 cond 0x1 (EMPTY)
                             zone 1 cond 0xff (ACTIVE)

The uapi header marks BLKREPORTZONE as deprecated in favour of
BLKREPORTZONEV2. A program that follows this and does not ask for
cached information can no longer tell open zones from closed ones, and
is handed BLK_ZONE_COND_ACTIVE, which is only defined for the cached
report.

Call blkdev_report_zones_cached() only if BLK_ZONE_REP_CACHED is set,
and blkdev_report_zones() otherwise.

Tested with zoned null_blk devices in qemu: a program that compares
the reports of BLKREPORTZONE and BLKREPORTZONEV2 with flags 0 after
the sequence above finds the differences before this change and none
with it. The report with BLK_ZONE_REP_CACHED is unchanged.

Fixes: b30ffcdc0c15 ("block: introduce BLKREPORTZONESV2 ioctl")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
---
Prepared with Claude Code (Anthropic), model Claude Opus 5.5
(claude-opus-5-5).

 block/blk-zoned.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 475aa16bc4..9555eae91a 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -400,6 +400,13 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, unsigned int cmd,
 	case BLKREPORTZONEV2:
 		if (rep.flags & ~BLK_ZONE_REPV2_INPUT_FLAGS)
 			return -EINVAL;
+		if (!(rep.flags & BLK_ZONE_REP_CACHED)) {
+			ret = blkdev_report_zones(bdev, rep.sector,
+						  rep.nr_zones,
+						  blkdev_copy_zone_to_user,
+						  &args);
+			break;
+		}
 		ret = blkdev_report_zones_cached(bdev, rep.sector, rep.nr_zones,
 					 blkdev_copy_zone_to_user, &args);
 		break;
-- 
2.43.0

Re: [PATCH 1/2] block: only use the cached zone report if BLK_ZONE_REP_CACHED is set

[Damien Le Moal]

On 2026/10/11 7:19, Shashank Mohan Jain wrote:
> BLKREPORTZONEV2 takes the flags field of struct blk_zone_report as an
> input. With BLK_ZONE_REP_CACHED the report is built from the zone
> information cached by the block layer. Without it, BLKREPORTZONEV2 is
> documented to behave like BLKREPORTZONE and to get the report from the
> device: this is what the changelog of the commit that added the ioctl
> and the comments in include/uapi/linux/blkzoned.h say.
> 
> blkdev_report_zones_ioctl() only uses the flag to validate the input
> and calls blkdev_report_zones_cached() for every BLKREPORTZONEV2
> request. A caller that passes flags == 0 gets the cached report, in
> which implicitly open, explicitly open and closed zones all have the
> condition BLK_ZONE_COND_ACTIVE, and an explicitly opened empty zone is
> reported as empty.
> 
> Example with a zoned null_blk device (10 MiB, 4 MiB zones) after
> BLKOPENZONE on zone 0, and a write of 8 sectors to zone 1 followed by
> BLKCLOSEZONE:
> 
>   BLKREPORTZONE:             zone 0 cond 0x3 (EXP_OPEN)
>                              zone 1 cond 0x4 (CLOSED)
>   BLKREPORTZONEV2, flags 0:  zone 0 cond 0x1 (EMPTY)
>                              zone 1 cond 0xff (ACTIVE)
> 
> The uapi header marks BLKREPORTZONE as deprecated in favour of
> BLKREPORTZONEV2. A program that follows this and does not ask for
> cached information can no longer tell open zones from closed ones, and
> is handed BLK_ZONE_COND_ACTIVE, which is only defined for the cached
> report.
> 
> Call blkdev_report_zones_cached() only if BLK_ZONE_REP_CACHED is set,
> and blkdev_report_zones() otherwise.
> 
> Tested with zoned null_blk devices in qemu: a program that compares
> the reports of BLKREPORTZONE and BLKREPORTZONEV2 with flags 0 after
> the sequence above finds the differences before this change and none
> with it. The report with BLK_ZONE_REP_CACHED is unchanged.
> 
> Fixes: b30ffcdc0c15 ("block: introduce BLKREPORTZONESV2 ioctl")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
> ---
> Prepared with Claude Code (Anthropic), model Claude Opus 5.5
> (claude-opus-5-5).
> 
>  block/blk-zoned.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/block/blk-zoned.c b/block/blk-zoned.c
> index 475aa16bc4..9555eae91a 100644
> --- a/block/blk-zoned.c
> +++ b/block/blk-zoned.c
> @@ -400,6 +400,13 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, unsigned int cmd,
>  	case BLKREPORTZONEV2:
>  		if (rep.flags & ~BLK_ZONE_REPV2_INPUT_FLAGS)
>  			return -EINVAL;
> +		if (!(rep.flags & BLK_ZONE_REP_CACHED)) {
> +			ret = blkdev_report_zones(bdev, rep.sector,
> +						  rep.nr_zones,
> +						  blkdev_copy_zone_to_user,
> +						  &args);
> +			break;
> +		}
>  		ret = blkdev_report_zones_cached(bdev, rep.sector, rep.nr_zones,
>  					 blkdev_copy_zone_to_user, &args);

Can you reverse this if to be "if (rep.flags & BLK_ZONE_REP_CACHED) {" and to
call blkdev_report_zones_cached if the condition is true? That would be a lot
more logical.

Also, the condition should probably be:

	if ((rep.flags & BLK_ZONE_REP_CACHED) &&
	    blkdev_has_cached_report_zones(bdev))

to be more efficient and avoid a call to blkdev_report_zones_cached() which will
turn into a regular device report zones.


-- 
Damien Le Moal
Western Digital Research

Re: [PATCH 1/2] block: only use the cached zone report if BLK_ZONE_REP_CACHED is set

[shashank Jain]

On Sun, Oct 11, 2026, Damien Le Moal wrote:
> Can you reverse this if to be "if (rep.flags & BLK_ZONE_REP_CACHED) {" ...
> Also, the condition should probably be:
>         if ((rep.flags & BLK_ZONE_REP_CACHED) &&
>             blkdev_has_cached_report_zones(bdev))

Reworked exactly as suggested and reposted as v2:
  https://lore.kernel.org/all/20261011154018.48913-1-jain.sm@gmail.com/

blkdev_has_cached_report_zones() is now used from the ioctl, so I moved
it (with its comment) above blkdev_report_zones_ioctl(). Patch 2 is
unchanged and carries your Reviewed-by. Retested on zoned null_blk.

Thanks,
Shashank

On Sun, Oct 11, 2026 at 8:16 PM Damien Le Moal <dlemoal@kernel.org> wrote:
>
> On 2026/10/11 7:19, Shashank Mohan Jain wrote:
> > BLKREPORTZONEV2 takes the flags field of struct blk_zone_report as an
> > input. With BLK_ZONE_REP_CACHED the report is built from the zone
> > information cached by the block layer. Without it, BLKREPORTZONEV2 is
> > documented to behave like BLKREPORTZONE and to get the report from the
> > device: this is what the changelog of the commit that added the ioctl
> > and the comments in include/uapi/linux/blkzoned.h say.
> >
> > blkdev_report_zones_ioctl() only uses the flag to validate the input
> > and calls blkdev_report_zones_cached() for every BLKREPORTZONEV2
> > request. A caller that passes flags == 0 gets the cached report, in
> > which implicitly open, explicitly open and closed zones all have the
> > condition BLK_ZONE_COND_ACTIVE, and an explicitly opened empty zone is
> > reported as empty.
> >
> > Example with a zoned null_blk device (10 MiB, 4 MiB zones) after
> > BLKOPENZONE on zone 0, and a write of 8 sectors to zone 1 followed by
> > BLKCLOSEZONE:
> >
> >   BLKREPORTZONE:             zone 0 cond 0x3 (EXP_OPEN)
> >                              zone 1 cond 0x4 (CLOSED)
> >   BLKREPORTZONEV2, flags 0:  zone 0 cond 0x1 (EMPTY)
> >                              zone 1 cond 0xff (ACTIVE)
> >
> > The uapi header marks BLKREPORTZONE as deprecated in favour of
> > BLKREPORTZONEV2. A program that follows this and does not ask for
> > cached information can no longer tell open zones from closed ones, and
> > is handed BLK_ZONE_COND_ACTIVE, which is only defined for the cached
> > report.
> >
> > Call blkdev_report_zones_cached() only if BLK_ZONE_REP_CACHED is set,
> > and blkdev_report_zones() otherwise.
> >
> > Tested with zoned null_blk devices in qemu: a program that compares
> > the reports of BLKREPORTZONE and BLKREPORTZONEV2 with flags 0 after
> > the sequence above finds the differences before this change and none
> > with it. The report with BLK_ZONE_REP_CACHED is unchanged.
> >
> > Fixes: b30ffcdc0c15 ("block: introduce BLKREPORTZONESV2 ioctl")
> > Cc: stable@vger.kernel.org
> > Assisted-by: LLM
> > Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
> > ---
> > Prepared with Claude Code (Anthropic), model Claude Opus 5.5
> > (claude-opus-5-5).
> >
> >  block/blk-zoned.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/block/blk-zoned.c b/block/blk-zoned.c
> > index 475aa16bc4..9555eae91a 100644
> > --- a/block/blk-zoned.c
> > +++ b/block/blk-zoned.c
> > @@ -400,6 +400,13 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, unsigned int cmd,
> >       case BLKREPORTZONEV2:
> >               if (rep.flags & ~BLK_ZONE_REPV2_INPUT_FLAGS)
> >                       return -EINVAL;
> > +             if (!(rep.flags & BLK_ZONE_REP_CACHED)) {
> > +                     ret = blkdev_report_zones(bdev, rep.sector,
> > +                                               rep.nr_zones,
> > +                                               blkdev_copy_zone_to_user,
> > +                                               &args);
> > +                     break;
> > +             }
> >               ret = blkdev_report_zones_cached(bdev, rep.sector, rep.nr_zones,
> >                                        blkdev_copy_zone_to_user, &args);
>
> Can you reverse this if to be "if (rep.flags & BLK_ZONE_REP_CACHED) {" and to
> call blkdev_report_zones_cached if the condition is true? That would be a lot
> more logical.
>
> Also, the condition should probably be:
>
>         if ((rep.flags & BLK_ZONE_REP_CACHED) &&
>             blkdev_has_cached_report_zones(bdev))
>
> to be more efficient and avoid a call to blkdev_report_zones_cached() which will
> turn into a regular device report zones.
>
>
> --
> Damien Le Moal
> Western Digital Research

[PATCH 2/2] block: fix the length of a smaller last zone in blkdev_get_zone_info()

[Shashank Mohan Jain]

blkdev_get_zone_info() sets the length of every zone to the zone size
of the device. The last zone of a zoned block device may be smaller
than the others: blk_revalidate_zone_cb() accepts that and remembers
the capacity of that zone in disk->last_zone_capacity. For such a zone
the length reported from the cached information is too large, and
start + len is beyond the end of the device. A conventional last zone
is also given the capacity of a full zone.

Example with a zoned null_blk device of 10 MiB (20480 sectors) with
4 MiB zones, last zone:

  BLKREPORTZONE:       start 16384 len 4096 capacity 4096
  BLKREPORTZONEV2 with
  BLK_ZONE_REP_CACHED: start 16384 len 8192 capacity 4096

Limit the length to what is left of the device. disk_zone_is_last()
still recognises the last zone, as start + len is then equal to the
capacity of the device. The capacity of a conventional zone is equal
to its length, which blk_revalidate_conv_zone() checks, so use the
length there.

Tested with zoned null_blk devices in qemu (all zones sequential, and
two conventional zones followed by sequential ones, both with a smaller
last zone): the start, length and capacity of all zones in the cached
report are the same as in the report from the device with this change.
null_blk cannot create a device with a conventional last zone, so that
case is not tested.

Fixes: f2284eec5053 ("block: introduce blkdev_get_zone_info()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>
---
Prepared with Claude Code (Anthropic), model Claude Opus 5.5
(claude-opus-5-5).

 block/blk-zoned.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 9555eae91a..ca0950be3e 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -971,7 +971,7 @@ int blkdev_get_zone_info(struct block_device *bdev, sector_t sector,
 	rcu_read_unlock();
 
 	zone->start = sector;
-	zone->len = zone_sectors;
+	zone->len = min(zone_sectors, get_capacity(disk) - sector);
 
 	/*
 	 * If this is a conventional zone, we do not have a zone write plug and
@@ -979,7 +979,7 @@ int blkdev_get_zone_info(struct block_device *bdev, sector_t sector,
 	 */
 	if (zone->cond == BLK_ZONE_COND_NOT_WP) {
 		zone->type = BLK_ZONE_TYPE_CONVENTIONAL;
-		zone->capacity = zone_sectors;
+		zone->capacity = zone->len;
 		zone->wp = ULLONG_MAX;
 		return 0;
 	}
-- 
2.43.0

Re: [PATCH 2/2] block: fix the length of a smaller last zone in blkdev_get_zone_info()

[Damien Le Moal]

On 2026/10/11 7:19, Shashank Mohan Jain wrote:
> blkdev_get_zone_info() sets the length of every zone to the zone size
> of the device. The last zone of a zoned block device may be smaller
> than the others: blk_revalidate_zone_cb() accepts that and remembers
> the capacity of that zone in disk->last_zone_capacity. For such a zone
> the length reported from the cached information is too large, and
> start + len is beyond the end of the device. A conventional last zone
> is also given the capacity of a full zone.
> 
> Example with a zoned null_blk device of 10 MiB (20480 sectors) with
> 4 MiB zones, last zone:
> 
>   BLKREPORTZONE:       start 16384 len 4096 capacity 4096
>   BLKREPORTZONEV2 with
>   BLK_ZONE_REP_CACHED: start 16384 len 8192 capacity 4096
> 
> Limit the length to what is left of the device. disk_zone_is_last()
> still recognises the last zone, as start + len is then equal to the
> capacity of the device. The capacity of a conventional zone is equal
> to its length, which blk_revalidate_conv_zone() checks, so use the
> length there.
> 
> Tested with zoned null_blk devices in qemu (all zones sequential, and
> two conventional zones followed by sequential ones, both with a smaller
> last zone): the start, length and capacity of all zones in the cached
> report are the same as in the report from the device with this change.
> null_blk cannot create a device with a conventional last zone, so that
> case is not tested.
> 
> Fixes: f2284eec5053 ("block: introduce blkdev_get_zone_info()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Shashank Mohan Jain <jain.sm@gmail.com>

Doh! Good catch.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research