[PATCH] dm: fix infinite loop in dm_blk_do_report_zones()

[PATCH] dm: fix infinite loop in dm_blk_do_report_zones()

[Mark Bundschuh]

If the device underlying a zoned target is removed, its capacity is set
to 0 and blkdev_report_zones() returns 0 without reporting any zones.
The mapped device keeps its old capacity, so args->zone_idx and
args->next_sector never advance and dm_blk_do_report_zones() loops
forever. On non-preemptible kernels this causes soft lockups and RCU
stalls.

The following sequence of commands triggers the hang:

modprobe scsi_debug zbc=managed dev_size_mb=1024 zone_size_mb=64
udevadm settle
echo '0 2097152 linear /dev/sda 0' | dmsetup create lin
echo 1 > /sys/block/sda/device/delete
blkzone report -o 0 -c 1 /dev/mapper/lin

Fix this by returning -EIO when a target reports no zones. The target
always maps args->next_sector, so a zero return means the underlying
device no longer covers that sector.

Fixes: d41003513e61 ("block: rework zone reporting")
Cc: stable@vger.kernel.org
Signed-off-by: Mark Bundschuh <mkbund@amazon.com>
---
 drivers/md/dm-zone.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/md/dm-zone.c b/drivers/md/dm-zone.c
index f29acf64429a..ce4f94685a78 100644
--- a/drivers/md/dm-zone.c
+++ b/drivers/md/dm-zone.c
@@ -33,6 +33,8 @@ static int dm_blk_do_report_zones(struct mapped_device *md, struct dm_table *t,
 					      nr_zones - args->zone_idx);
 		if (ret < 0)
 			return ret;
+		if (!ret)
+			return -EIO;
 	} while (args->zone_idx < nr_zones &&
 		 args->next_sector < get_capacity(md->disk));
 
-- 
2.50.1

Re: [PATCH] dm: fix infinite loop in dm_blk_do_report_zones()

[Damien Le Moal]

On 2026/10/19 21:28, Mark Bundschuh wrote:
> If the device underlying a zoned target is removed, its capacity is set
> to 0 and blkdev_report_zones() returns 0 without reporting any zones.
> The mapped device keeps its old capacity, so args->zone_idx and
> args->next_sector never advance and dm_blk_do_report_zones() loops
> forever. On non-preemptible kernels this causes soft lockups and RCU
> stalls.
> 
> The following sequence of commands triggers the hang:
> 
> modprobe scsi_debug zbc=managed dev_size_mb=1024 zone_size_mb=64
> udevadm settle
> echo '0 2097152 linear /dev/sda 0' | dmsetup create lin
> echo 1 > /sys/block/sda/device/delete
> blkzone report -o 0 -c 1 /dev/mapper/lin
> 
> Fix this by returning -EIO when a target reports no zones. The target
> always maps args->next_sector, so a zero return means the underlying
> device no longer covers that sector.
> 
> Fixes: d41003513e61 ("block: rework zone reporting")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mark Bundschuh <mkbund@amazon.com>

Looks good.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research