[PATCH] zloop: reject mismatched conventional zone files on restore

[PATCH] zloop: reject mismatched conventional zone files on restore

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

When restoring a zloop device, zloop_init_zone() checks that the size of
each conventional zone file matches the configured zone size.  The check
prints an error and then jumps to out_fput, which releases the zone file
and returns the value left in "ret" by the preceding vfs_getattr() call,
that is, zero.  zloop_ctl_add() therefore treats the zone as initialized
and continues with a zone->file pointer that was already released; any
I/O to that zone then dereferences it.

Return -EINVAL, like the sequential zone path does for the same kind of
inconsistency.

While at it, print the zone size that is actually compared instead of the
zone capacity, which may be smaller and only made the message confusing.

Fixes: eb0570c7df23 ("block: new zoned loop block device driver")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---

diff --git a/drivers/block/zloop.c b/drivers/block/zloop.c
index 65634a39b0bf..fb541969a47c 100644
--- a/drivers/block/zloop.c
+++ b/drivers/block/zloop.c
@@ -1161,7 +1161,8 @@ static int zloop_init_zone(struct zloop_device *zlo, struct zloop_options *opts,

 		if (restore && file_sectors != zlo->zone_size) {
 			pr_err("Invalid conventional zone %u file size (%llu sectors != %llu)\n",
-			       zone_no, file_sectors, zlo->zone_capacity);
+			       zone_no, file_sectors, zlo->zone_size);
+			ret = -EINVAL;
 			goto out_fput;
 		}

Re: [PATCH] zloop: reject mismatched conventional zone files on restore

[Damien Le Moal]

On 10/31/26 23:16, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> When restoring a zloop device, zloop_init_zone() checks that the size of
> each conventional zone file matches the configured zone size.  The check
> prints an error and then jumps to out_fput, which releases the zone file
> and returns the value left in "ret" by the preceding vfs_getattr() call,
> that is, zero.  zloop_ctl_add() therefore treats the zone as initialized
> and continues with a zone->file pointer that was already released; any
> I/O to that zone then dereferences it.
> 
> Return -EINVAL, like the sequential zone path does for the same kind of
> inconsistency.
> 
> While at it, print the zone size that is actually compared instead of the
> zone capacity, which may be smaller and only made the message confusing.
> 
> Fixes: eb0570c7df23 ("block: new zoned loop block device driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research

Re: [PATCH] zloop: reject mismatched conventional zone files on restore

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] zloop: reject mismatched conventional zone files on restore

[Jens Axboe]

On Sat, 31 Oct 2026 22:16:10 +0800, shao.mingyin@zte.com.cn wrote:
> When restoring a zloop device, zloop_init_zone() checks that the size of
> each conventional zone file matches the configured zone size.  The check
> prints an error and then jumps to out_fput, which releases the zone file
> and returns the value left in "ret" by the preceding vfs_getattr() call,
> that is, zero.  zloop_ctl_add() therefore treats the zone as initialized
> and continues with a zone->file pointer that was already released; any
> I/O to that zone then dereferences it.
> 
> [...]

Applied, thanks!

[1/1] zloop: reject mismatched conventional zone files on restore
      commit: 09c2e203e0ea8b68e7c9500401fa0ab60baf1a9d

Best regards,
-- 
Jens Axboe