Re: [PATCH] block: blk-zoned: fix zwplug refcount leak on write error path

[kernel test robot <oliver.sang@intel.com>]

Hello,

kernel test robot noticed "RIP:disk_free_zone_wplug" on:

commit: d9343256aa173471dbb7f3e02a2177801f2f2136 ("[PATCH] block: blk-zoned: fix zwplug refcount leak on write error path")
url: https://github.com/intel-lab-lkp/linux/commits/Wentao-Liang/block-blk-zoned-fix-zwplug-refcount-leak-on-write-error-path/20260526-234750
base: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux.git for-next
patch link: https://lore.kernel.org/all/20260526141824.2293025-1-vulab@iscas.ac.cn/
patch subject: [PATCH] block: blk-zoned: fix zwplug refcount leak on write error path

in testcase: blktests
version: blktests-x86_64-9131687-1_20260529
with following parameters:

	test: zbd-004


config: x86_64-rhel-9.4-func
compiler: gcc-14
test machine: 16 threads Intel(R) Core(TM) i7-13620H (Raptor Lake) with 32G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202605311048.34c03950-lkp@intel.com



[   38.687737][  T420] INFO: lkp CACHE_DIR is /opt/rootfs/tmp
[   38.687747][  T420]
[   40.261858][ T1207] loop: module loaded
[   40.340461][ T1252] null_blk: disk nullb0 created
[   40.341026][ T1252] null_blk: module loaded
[   40.347691][ T1255] null_blk: nullb1: using native zone append
[   40.349880][ T1255] null_blk: disk nullb1 created
[   40.402539][ T1255] run blktests zbd/004 at 2026-05-30 10:54:31
[   40.445801][ T1286] ------------[ cut here ]------------
[   40.446398][ T1286] WARNING: block/blk-zoned.c:590 at disk_free_zone_wplug+0x26b/0x330, CPU#3: dd/1286
[   40.447008][ T1286] Modules linked in: null_blk loop btrfs libblake2b zstd_compress raid6_pq xor binfmt_misc snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc269 snd_hda_codec_realtek_lib snd_hda_scodec_component snd_hda_codec_generic snd_hda_intel snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda soundwire_cadence intel_rapl_msr snd_sof_pci snd_sof_xtensa_dsp snd_soc_sdw_utils intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal snd_sof snd_sof_utils snd_soc_acpi_intel_match snd_soc_acpi_intel_sdca_quirks soundwire_generic_allocation snd_soc_acpi crc8 soundwire_bus snd_soc_sdca intel_powerclamp coretemp snd_soc_avs snd_soc_hda_codec snd_hda_ext_core spi_pxa2xx_platform snd_hda_codec dw_dmac kvm_intel snd_hda_core spi_pxa2xx_core i915 snd_intel_dspcfg snd_intel_sdw_acpi processor_thermal_device_pci snd_hwdep processor_thermal_device kvm intel_gtt
[   40.447061][ T1286]  processor_thermal_wt_hint drm_buddy snd_soc_core ttm btusb platform_temperature_control iwlwifi btrtl snd_compress processor_thermal_soc_slider drm_display_helper spi_nor btintel processor_thermal_rfim snd_pcm irqbypass think_lmi cec processor_thermal_rapl btbcm rapl intel_rapl_common drm_client_lib btmtk drm_kms_helper mtd intel_pmc_core snd_timer ahci intel_cstate intel_lpss_pci processor_thermal_wt_req cfg80211 firmware_attributes_class wmi_bmof bluetooth pmt_telemetry video libahci processor_thermal_power_floor mei_me snd spi_intel_pci i2c_i801 pmt_discovery processor_thermal_mbox intel_lpss intel_uncore libata pl2303 pmt_class i2c_smbus pcspkr idma64 spi_intel rfkill soundcore mei int340x_thermal_zone wmi intel_pmc_ssram_telemetry int3400_thermal acpi_thermal_rel intel_vsec pinctrl_tigerlake acpi_pad acpi_tad drm fuse nfnetlink
[   40.452569][ T1286] CPU: 3 UID: 0 PID: 1286 Comm: dd Tainted: G S      W           7.1.0-rc3+ #1 PREEMPT(lazy)
[   40.453213][ T1286] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[   40.453849][ T1286] Hardware name: LENOVO 90XW004HPL/336B, BIOS M5LKT1CA 01/06/2025
[   40.454439][ T1286] RIP: 0010:disk_free_zone_wplug (blk-zoned.c:592 (discriminator 1))
[   40.455005][ T1286] Code: 5d 41 5e 41 5f e9 f5 fc e2 fe 83 e2 07 38 d0 7f 08 84 c0 0f 85 82 00 00 00 41 c6 04 24 ff e9 15 ff ff ff 0f 0b e9 2c fe ff ff <0f> 0b a8 01 0f 84 f8 fd ff ff 0f 0b e9 f1 fd ff ff e8 bf 7a 61 ff
All code
========
   0:	5d                   	pop    %rbp
   1:	41 5e                	pop    %r14
   3:	41 5f                	pop    %r15
   5:	e9 f5 fc e2 fe       	jmp    0xfffffffffee2fcff
   a:	83 e2 07             	and    $0x7,%edx
   d:	38 d0                	cmp    %dl,%al
   f:	7f 08                	jg     0x19
  11:	84 c0                	test   %al,%al
  13:	0f 85 82 00 00 00    	jne    0x9b
  19:	41 c6 04 24 ff       	movb   $0xff,(%r12)
  1e:	e9 15 ff ff ff       	jmp    0xffffffffffffff38
  23:	0f 0b                	ud2
  25:	e9 2c fe ff ff       	jmp    0xfffffffffffffe56
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	a8 01                	test   $0x1,%al
  2e:	0f 84 f8 fd ff ff    	je     0xfffffffffffffe2c
  34:	0f 0b                	ud2
  36:	e9 f1 fd ff ff       	jmp    0xfffffffffffffe2c
  3b:	e8 bf 7a 61 ff       	call   0xffffffffff617aff

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	a8 01                	test   $0x1,%al
   4:	0f 84 f8 fd ff ff    	je     0xfffffffffffffe02
   a:	0f 0b                	ud2
   c:	e9 f1 fd ff ff       	jmp    0xfffffffffffffe02
  11:	e8 bf 7a 61 ff       	call   0xffffffffff617ad5
[   40.455652][ T1286] RSP: 0018:ffffc9000179f4d8 EFLAGS: 00010246
[   40.456258][ T1286] RAX: 0000000000000000 RBX: ffff888883a71800 RCX: ffffffff8293c99a
[   40.456863][ T1286] RDX: 1ffff1111074e30e RSI: 0000000000000004 RDI: ffff888883a71870
[   40.457503][ T1286] RBP: ffff8881efd97000 R08: 0000000000000001 R09: ffffed111074e30d
[   40.458107][ T1286] R10: ffff888883a7186f R11: ffff888200fac01c R12: ffff888890e92940
[   40.458785][ T1286] R13: ffff88889dac03f8 R14: 000000096a349520 R15: ffff8888a6d6b780
[   40.459408][ T1286] FS:  00007f265573c780(0000) GS:ffff8887cd24b000(0000) knlGS:0000000000000000
[   40.460016][ T1286] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   40.460681][ T1286] CR2: 000055b746683f88 CR3: 000000019ef16006 CR4: 0000000000f72ef0
[   40.461295][ T1286] PKRU: 55555554
[   40.461905][ T1286] Call Trace:
[   40.462554][ T1286]  <TASK>
[   40.463161][ T1286]  blk_mq_finish_request (blk.h:548 blk-mq.c:786)
[   40.463864][ T1286]  __blk_mq_end_request (blk-mq.c:1164)
[   40.464518][ T1286] null_queue_rq (block/null_blk/main.c:1703 (discriminator 1)) null_blk
[   40.465132][ T1286] null_queue_rqs (block/null_blk/main.c:1717) null_blk
[   40.465828][ T1286]  ? __pfx_null_queue_rqs (block/null_blk/main.c:1326) null_blk
[   40.466460][ T1286]  ? _raw_spin_lock_irqsave (linux/instrumented.h:55 linux/atomic/atomic-instrumented.h:1301 asm-generic/qspinlock.h:111 linux/spinlock.h:187 linux/spinlock_api_smp.h:133 locking/spinlock.c:166)
[   40.467069][ T1286]  ? __pfx__raw_spin_lock_irqsave (locking/spinlock.c:273)
[   40.467748][ T1286]  blk_mq_dispatch_queue_requests (blk-mq.c:2903 (discriminator 1))
[   40.468362][ T1286]  blk_mq_flush_plug_list (blk-mq.c:2991)
[   40.469031][ T1286]  ? blk_account_io_start (blk-mq.c:1145 blk-mq.c:1121)
[   40.469695][ T1286]  ? __pfx_blk_mq_flush_plug_list (blk-mq.h:364 (discriminator 1))
[   40.470310][ T1286]  ? blk_mq_submit_bio (blk-mq.c:3231)
[   40.470968][ T1286]  __blk_flush_plug (blk-core.c:1229)
[   40.471617][ T1286]  ? __pfx___blk_flush_plug (linux/list.h:46 (discriminator 2))
[   40.472224][ T1286]  ? gup_fast_fallback (gup.c:3202)
[   40.472917][ T1286]  __submit_bio (blk-core.c:1256 blk-core.c:648)
[   40.473551][ T1286]  ? get_page_from_freelist (page_alloc.c:1866 page_alloc.c:3946)
[   40.474215][ T1286]  ? __pfx___submit_bio (blk-core.c:1257 (discriminator 1))
[   40.474900][ T1286]  submit_bio_noacct_nocheck (blk-core.c:721 blk-core.c:752)
[   40.475528][ T1286]  ? __pfx_submit_bio_noacct_nocheck (blk-core.c:712)
[   40.476196][ T1286]  ? submit_bio_noacct (blk-core.c:881)
[   40.476875][ T1286]  bio_await (bio.c:1499)
[   40.477495][ T1286]  ? __pfx_bio_await (bio.c:1471)
[   40.478094][ T1286]  ? bio_iov_iter_get_pages (bio.c:1266)
[   40.478753][ T1286]  submit_bio_wait (bio.c:1517)
[   40.479354][[   40.483105][ T1286]  blkdev_write_iter (fops.c:722 fops.c:790)
[   40.483748][ T1286]  vfs_write (read_write.c:595 read_write.c:688)
[   40.484345][ T1286]  ? __pfx_vfs_write (linux/percpu-rwsem.h:131 (discriminator 38))
[   40.484934][ T1286]  ? __pfx_css_rstat_updated (cgroup/rstat.c:548)
[   40.485546][ T1286]  ? do_syscall_64+[   40.570578][ T1287] ------------[ cut here ]------------
[   40.571274][ T1287] refcount_t: underflow; use-after-free.
[   40.571922][ T1287] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xa9/0xf0, CPU#12: dd/1287
[   40.572594][ T1287] Modules linked in: null_blk loop btrfs libblake2b zstd_compress raid6_pq xor binfmt_misc snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc269 snd_hda_codec_realtek_lib snd_hda_scodec_component snd_hda_codec_generic snd_hda_intel snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda soundwire_cadence intel_rapl_msr snd_sof_pci snd_sof_xtensa_dsp snd_soc_sdw_utils[   40.572665][ T1287]  processor_thermal_wt_hint drm_buddy snd_soc_core ttm btusb platform_temperature_control iwlwifi btrtl snd_compress processor_thermal_soc_slider drm_display_helper spi_nor btintel processor_thermal_rfim snd_pcm irqbypass think_lmi ce[   40.595153][ T1287]  ? __pfx__raw_spin_lock_irqsave (locking/spinlock.c:273)
[   40.595903][ T1287]  blk_mq_dispatch_queue_requests (blk-mq.c:2903 (discriminator 1))
[   40.596653][ T1287]  blk_mq_flush_plug_list (blk-mq.c:2991)
[   40.597402][ T1287]  ? blk_account_io_start (blk-mq.c:1145 blk-mq.c:1121)
[ [   40.617272][ T1287]  ? folio_add_lru_vma (swap.c:536)
[   40.617965][ T1287]  ksys_write (read_write.c:740)
[   40.618658][ T1287]  ? __pfx_ksys_write (read_write.c:724)
[   40.619354][ T1287]  ? folio_add_new_anon_rmap (linux/instrumented.h:82 asm-generic/bitops/instrumented-non-atomic.h:141 linux/page-flags.h:843 linux/page-flags.h:864 linux/mm.h:1724 rmap.c:1697)
[   40.620041][ T1287]  do_syscall_[   43.443332][  T420] LKP: stdout: 365:  /lkp/lkp/src/bin/run-lkp /lkp/jobs/scheduled/igk-rpl-d05/blktests-zbd-004-debian-13-x86_64-20250902.cgz-d9343256aa17-20260530-48630-1qqgxqy-5.yaml
[   43.443340][  T420]
[   43.445914][  T420] RESULT_ROOT=/result/blktests/zbd-004/igk-rpl-d05/debian-13-x86_64-20250902.cgz/x86_64-rhel-9.4-func/gcc-14/d9343256aa173471dbb7f3e02a2177801f2f2136/5
[   43.445920][  T420]
[   43.448290][  T420] job=/lkp/jobs/scheduled/igk-rpl-d05/blktests-zbd-004-debian-13-x86_64-20250902.cgz-d9343256aa17-20260530-48630-1qqgxqy-5.yaml
[   43.448293][  T420]
[   49.435619][  T420] result_service: raw_upload, RESULT_MNT: /internal-lkp-server/result, RESULT_ROOT: /internal-lkp-server/result/blktests/zbd-004/igk-rpl-d05/debian-13-x86_64-20250902.cgz/x86_64-rhel-9.4-func/gcc-14/d9343256aa173471dbb7f3e02a2177801f2f2136/5, TMP_RESULT_ROOT: /tmp/lkp/result
[   49.435628][  T420]
[   49.438631][  T420] run-job /lkp/jobs/scheduled/igk-rpl-d05/blktests-zbd-004-debian-13-x86_64-20250902.cgz-d9343256aa17-20260530-48630-1qqgxqy-5.yaml
[   49.438634][  T420]
[   50.297903][  T420] /usr/bin/wget -q --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/igk-rpl-d05/blktests-zbd-004-debian-13-x86_64-20250902.cgz-d9343256aa17-20260530-48630-1qqgxqy-5.yaml&job_state=running -O /dev/null
[   50.297912][  T420]
[   50.300165][  T420] target ucode: 0x4129
[   50.300168][  T420]
[   50.301778][  T420] LKP: stdout: 1009: current_version: 4129, target_version: 4129
[   50.301791][  T420]
[   50.302957][  T420] check_nr_cpu
[   50.302959][  T420]
[   50.304375][  T420] CPU(s):                                  16
[   50.304378][  T420]
[   50.305812][  T420] On-line CPU(s) list:                     0-15
[   50.305815][  T420]
[   50.307490][  T420] Model name:                              13th Gen Intel(R) Core(TM) i7-13620H
[   50.307494][  T420]
[   50.308972][  T420] Thread(s) per core:                      2
[   50.308974][  T420]
[   50.310450][  T420] Core(s) per socket:                      10
[   50.310453][  T420]
[   50.311846][  T420] Socket(s):                               1
[   50.311849][  T420]
[   50.313233][  T420] CPU(s) scaling MHz:                      30%
[   50.313236][  T420]
[   50.314648][  T420] NUMA node(s):                            1
[   50.314650][  T420]
[   50.316064][  T420] NUMA node0 CPU(s):                       0-15
[   50.316066][  T420]
[   50.317507][  T420] 2026-05-30 10:54:26 cd /lkp/benchmarks/blktests
[   50.317509][  T420]
[   50.319031][  T420] Defaulting to policy_version 2 because kernel supports it.
[   50.319034][  T420]
[   50.320596][  T420] Customizing passphrase hashing difficulty for this system...
[   50.320600][  T420]
[   50.322106][  T420] Created global config file at "/etc/fscrypt.conf".
[   50.322108][  T420]
[   50.323861][  T420] Allow users other than root to create fscrypt metadata on the root filesystem?
[   50.323864][  T420]
[   50.326241][  T420] (See https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem) [y/N] Metadata directories created at "/.fscrypt", writable by root only.
[   50.326244][  T420]
[   50.327687][  T420] 2026-05-30 10:54:31 echo zbd/004
[   50.327689][  T420]
[   50.329072][  T420] 2026-05-30 10:54:31 ./check zbd/004
[   50.329074][  T420]
[   50.330721][  T420] zbd/004 => nullb1 (write split across sequential zones)
[   50.330724][  T420]
[   50.332420][  T420] zbd/004 => nullb1 (write split across sequential zones)      [failed]
[   50.332423][  T420]
[   50.333796][  T420]     runtime    ...  0.246s
[   50.333798][  T420]
[   50.335223][  T420]     something found in dmesg:
[   50.335226][  T420]
[   50.336967][  T420]
[   40.402539] [   T1255] run blktests zbd/004 at 2026-05-30 10:54:31
[   50.336970][  T420]
[   50.338633][  T420]
[   40.445801] [   T1286] ------------[ cut here ]------------
[   50.338636][  T420]
[   50.340724][  T420]
[   40.446398] [   T1286] WARNING: block/blk-zoned.c:590 at disk_free_zone_wplug+0x26b/0x330, CPU#3: dd/1286
[   50.340727][  T420]
[   60.489873][ T1461] EXT4-fs (nvme0n1p3): unmounting filesystem 1516f48d-9247-4757-9a6e-5cfcf67431a2.
[   62.359503][    T1] watchdog: watchdog0: watchdog did not stop!
[   62.393655][    T1] watchdog: watchdog0: watchdog did not stop!
[   62.479655][    T1] r8169 0000:02:00.0 eth0: Link is Down
[    0.000000][    T0] Linux version 7.1.0-rc3+ (kbuild@6767f1d4f5ea) (gcc-14 (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #1 SMP PREEMPT_DYNAMIC Sat May 30 06:29:39 CEST 2026

The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260531/202605311048.34c03950-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki