[PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[Johannes Thumshirn]

On zoned devices, mkfs can leave a stale zone behind that is used as a
staging area but never reset. This zone is not backed by a chunk or
device extent, so the FS itself does not account it as used. On devices
that have a limitied active zone budget this can lead to premature
ENOSPC and/or an exhaustion of active zones.

Fix it in mkfs for new file-systems and also add a check to fsck to find
such zones and repair them with '--repair'.

Changes to v1:
- fix a bug in fsck where it had a stale return value propagated.

Johannes Thumshirn (2):
  btrfs-progs: zoned: refresh stale cached zone state in
    btrfs_reset_dev_zone()
  btrfs-progs: check: detect leaked active zones on zoned devices

 check/main.c          | 156 +++++++++++++++++++++++++++++++++++++++++-
 kernel-shared/zoned.c |  18 ++++-
 2 files changed, 170 insertions(+), 4 deletions(-)

--
2.55.0

[PATCH v2 1/2] btrfs-progs: zoned: refresh stale cached zone state in btrfs_reset_dev_zone()

[Johannes Thumshirn]

btrfs-progs reads the device zone layout once, in btrfs_get_zone_info() ->
report_zones() when the device is opened, and caches it in 'zinfo->zones[]'
without ever refreshing it afterwards. btrfs_reset_dev_zone() skips
resetting a zone whose cached condition is EMPTY, but that condition can be
stale: a zone written after open, for example a temporary chunk that mkfs
writes and then removes, can still be cached as EMPTY. Its reset is then
skipped and the zone is left open on the device, referenced by no chunk nor
dev extent, permanently consuming one of the device's limited active zones.
On a device with few active zones this results in premature ENOSPC or an
allocation hang.

Before skipping the reset of a supposedly empty zone, re-read its real
condition from the device and only skip if it is really empty.

Fixes: bfdb3ae23713 ("btrfs-progs: zoned: reset zone of freed block group")
Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 kernel-shared/zoned.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/kernel-shared/zoned.c b/kernel-shared/zoned.c
index 8a9d1f38..6b835b0c 100644
--- a/kernel-shared/zoned.c
+++ b/kernel-shared/zoned.c
@@ -276,11 +276,23 @@ int btrfs_reset_dev_zone(int fd, struct blk_zone *zone)
 {
 	struct blk_zone_range range;
 
-	/* Nothing to do if it is already empty */
-	if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL ||
-	    zone->cond == BLK_ZONE_COND_EMPTY)
+	if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
 		return 0;
 
+	if (zone->cond == BLK_ZONE_COND_EMPTY) {
+		char buf[sizeof(struct blk_zone_report) +
+			 sizeof(struct blk_zone)] = { 0 };
+		struct blk_zone_report *rep = (struct blk_zone_report *)buf;
+
+		rep->sector = zone->start;
+		rep->nr_zones = 1;
+		if (ioctl(fd, BLKREPORTZONE, rep) == 0 && rep->nr_zones == 1)
+			*zone = *(struct blk_zone *)(rep + 1);
+
+		if (zone->cond == BLK_ZONE_COND_EMPTY)
+			return 0;
+	}
+
 	range.sector = zone->start;
 	range.nr_sectors = zone->len;
 
-- 
2.55.0

[PATCH v2 2/2] btrfs-progs: check: detect leaked active zones on zoned devices

[Johannes Thumshirn]

On a zoned filesystem a sequential zone can end up open (and written) on
the device while it is not referenced by any dev extent and is not in a
sb-log zone. Such a zone is unreferenced - its space is free according to
the device tree - yet it stays active on the device, permanently consuming
one of the device's limited active zones. On a device with few active
zones this can lead to premature ENOSPC and/or allocation hangs.

One way to end up in this state is a mkfs that failed to reset a
temporary chunk's zone before finishing (fixed in a preceding commit).
Existing filesystems created by such a mkfs need a way to detect and
repair the condition.

Add a zoned device specific check that cross-checks the on-disk metadata
against the physical zone state of the device. It flags any written,
sequential zone that is not backed by a dev extent, and in
--repair mode resets it. The check is a no-op on non-zoned filesystems and
runs as part of the extent/device checking rather than as a separate
numbered check phase.

Introduce check_zoned() as a entry point for future zoned device checks.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 check/main.c | 156 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 155 insertions(+), 1 deletion(-)

diff --git a/check/main.c b/check/main.c
index b9649829..3ea90096 100644
--- a/check/main.c
+++ b/check/main.c
@@ -47,6 +47,7 @@
 #include "kernel-shared/ulist.h"
 #include "kernel-shared/file-item.h"
 #include "kernel-shared/tree-checker.h"
+#include "kernel-shared/zoned.h"
 #include "common/defs.h"
 #include "common/extent-cache.h"
 #include "common/internal.h"
@@ -9129,6 +9130,152 @@ out:
 	return ret;
 }
 
+/*
+ * On a zoned filesystem, find sequential zones that are open/written on the
+ * device but are not backed by any dev extent and are not superblock log
+ * zones. Such a zone is unreferenced yet it stays 'active' on the device,
+ * permanently consuming one of the device's limited active zones. This can
+ * cause premature ENOSPC or, on filesystems with a small number of active
+ * zones, allocation hangs.
+ */
+static int check_zoned_active_zones(void)
+{
+	struct btrfs_root *dev_root = gfs_info->dev_root;
+	struct btrfs_device *dev;
+	int ret = 0;
+
+	list_for_each_entry(dev, &gfs_info->fs_devices->devices, dev_list) {
+		struct btrfs_zoned_device_info *zinfo = dev->zone_info;
+		struct btrfs_path path = { 0 };
+		struct btrfs_key key;
+		unsigned long *covered;
+		int shift;
+		int i;
+
+		if (!zinfo || zinfo->model == ZONED_NONE)
+			continue;
+
+		shift = ilog2(zinfo->zone_size);
+		covered = calloc(BITS_TO_LONGS(zinfo->nr_zones),
+				 sizeof(unsigned long));
+		if (!covered)
+			return -ENOMEM;
+
+		/* Superblock log zones are written but not backed by a chunk. */
+		for (int mirror = 0; mirror < BTRFS_SUPER_MIRROR_MAX; mirror++) {
+			u32 sb_zno = sb_zone_number(shift, mirror);
+
+			if (sb_zno + BTRFS_NR_SB_LOG_ZONES > zinfo->nr_zones)
+				continue;
+			for (i = 0; i < BTRFS_NR_SB_LOG_ZONES; i++)
+				set_bit(sb_zno + i, covered);
+		}
+
+		key.objectid = dev->devid;
+		key.type = BTRFS_DEV_EXTENT_KEY;
+		key.offset = 0;
+		ret = btrfs_search_slot(NULL, dev_root, &key, &path, 0, 0);
+		if (ret < 0) {
+			btrfs_release_path(&path);
+			free(covered);
+			return ret;
+		}
+
+		while (1) {
+			struct btrfs_dev_extent *devext;
+			u64 pstart, plen, zno;
+
+			if (path.slots[0] >= btrfs_header_nritems(path.nodes[0])) {
+				ret = btrfs_next_leaf(dev_root, &path);
+				if (ret < 0) {
+					btrfs_release_path(&path);
+					free(covered);
+					return ret;
+				}
+				if (ret > 0)
+					break;
+			}
+
+			btrfs_item_key_to_cpu(path.nodes[0], &key, path.slots[0]);
+			if (key.objectid != dev->devid ||
+			    key.type != BTRFS_DEV_EXTENT_KEY)
+				break;
+
+			devext = btrfs_item_ptr(path.nodes[0], path.slots[0],
+					    struct btrfs_dev_extent);
+			pstart = key.offset;
+			plen = btrfs_dev_extent_length(path.nodes[0], devext);
+			for (zno = pstart >> shift;
+			     zno <= (pstart + plen - 1) >> shift; zno++) {
+				if (zno < zinfo->nr_zones)
+					set_bit(zno, covered);
+			}
+			path.slots[0]++;
+		}
+		btrfs_release_path(&path);
+
+		ret = 0;
+
+		for (i = 0; i < zinfo->nr_zones; i++) {
+			struct blk_zone *zone = &zinfo->zones[i];
+
+			if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
+				continue;
+			if (zone->cond == BLK_ZONE_COND_EMPTY)
+				continue;
+			if (test_bit(i, covered))
+				continue;
+
+			ret = 1;
+			error(
+"zoned: devid %llu zone %u is open/written but not referenced by any block group",
+			      dev->devid, i);
+			if (opt_check_repair) {
+				ret = btrfs_reset_dev_zone(dev->fd, zone);
+				if (ret) {
+					error(
+"zoned: failed to reset leaked zone %u on devid %llu: %m",
+					      i, dev->devid);
+					free(covered);
+					return ret;
+				}
+				printf("Reset leaked active zone %u on devid %llu\n",
+				       i, dev->devid);
+			}
+		}
+		free(covered);
+	}
+
+	return ret;
+}
+
+/*
+ * Zoned device consistency checks.
+ *
+ * These cross-check the on-disk metadata against the physical zone state of
+ * the underlying zoned device(s), as opposed to the tree-internal consistency
+ * checks done elsewhere. They are a no-op on non-zoned filesystems and are run
+ * as part of the device checking, not as a separate numbered check phase.
+ *
+ * Return 0 if clean, 1 if a problem was found (and not repaired), or a
+ * negative errno on a fatal error.
+ */
+static int check_zoned(void)
+{
+	int err = 0;
+	int ret;
+
+	if (!btrfs_is_zoned(gfs_info))
+		return 0;
+
+	ret = check_zoned_active_zones();
+	if (ret < 0)
+		return ret;
+	err |= ret;
+
+	return err;
+}
+
 /*
  * Check if all dev extents are valid (not overlapping nor beyond device
  * boundary).
@@ -9414,7 +9561,14 @@ static int do_check_chunks_and_extents(void)
 		return ret;
 
 	ret = check_and_repair_super_num_devs(gfs_info);
-	return ret;
+	if (ret)
+		return ret;
+
+	/*
+	 * Zoned device consistency checks. Not a separate numbered phase, run
+	 * as part of the extent/device checking. No-op on non-zoned.
+	 */
+	return check_zoned();
 }
 
 static struct extent_buffer *btrfs_fsck_clear_root(
-- 
2.55.0

Re: [PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[David Sterba]

On Fri, Sep 04, 2026 at 08:24:42AM +0200, Johannes Thumshirn wrote:
> On zoned devices, mkfs can leave a stale zone behind that is used as a
> staging area but never reset. This zone is not backed by a chunk or
> device extent, so the FS itself does not account it as used. On devices
> that have a limitied active zone budget this can lead to premature
> ENOSPC and/or an exhaustion of active zones.
> 
> Fix it in mkfs for new file-systems and also add a check to fsck to find
> such zones and repair them with '--repair'.
> 
> Changes to v1:
> - fix a bug in fsck where it had a stale return value propagated.
> 
> Johannes Thumshirn (2):
>   btrfs-progs: zoned: refresh stale cached zone state in
>     btrfs_reset_dev_zone()
>   btrfs-progs: check: detect leaked active zones on zoned devices

Added to devel, thanks.

Re: [PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[David Sterba]

On Fri, Sep 04, 2026 at 08:24:42AM +0200, Johannes Thumshirn wrote:
> On zoned devices, mkfs can leave a stale zone behind that is used as a
> staging area but never reset. This zone is not backed by a chunk or
> device extent, so the FS itself does not account it as used. On devices
> that have a limitied active zone budget this can lead to premature
> ENOSPC and/or an exhaustion of active zones.
> 
> Fix it in mkfs for new file-systems and also add a check to fsck to find
> such zones and repair them with '--repair'.
> 
> Changes to v1:
> - fix a bug in fsck where it had a stale return value propagated.
> 
> Johannes Thumshirn (2):
>   btrfs-progs: zoned: refresh stale cached zone state in
>     btrfs_reset_dev_zone()
>   btrfs-progs: check: detect leaked active zones on zoned devices

The build fails on older distros (Centos 8, Leap 15.3/16.0):

  CC       check/main.o
check/main.c: In function 'check_zoned_active_zones':
check/main.c:9220:12: error: 'struct blk_zone' has no member named 'type'
    if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
            ^~
check/main.c:9220:22: error: 'BLK_ZONE_TYPE_CONVENTIONAL' undeclared (first use in this function)
    if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~
check/main.c:9220:22: note: each undeclared identifier is reported only once for each function it appears in
check/main.c:9222:12: error: 'struct blk_zone' has no member named 'cond'
    if (zone->cond == BLK_ZONE_COND_EMPTY)
            ^~
check/main.c:9222:22: error: 'BLK_ZONE_COND_EMPTY' undeclared (first use in this function)
    if (zone->cond == BLK_ZONE_COND_EMPTY)
                      ^~~~~~~~~~~~~~~~~~~

The types were added in f5f2bad67a45 ("block: make the new blkzoned UAPI
constants discoverable") in 2016 and with the rest of the zoned userspace code
so it's not something recent.

I haven't looked what's the problem, this should be reproducible locally using
the "ci/ci-centos8" scripts (needs docker).

Re: [PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[David Sterba]

On Mon, Sep 14, 2026 at 07:40:12PM +0200, David Sterba wrote:
> On Fri, Sep 04, 2026 at 08:24:42AM +0200, Johannes Thumshirn wrote:
> > On zoned devices, mkfs can leave a stale zone behind that is used as a
> > staging area but never reset. This zone is not backed by a chunk or
> > device extent, so the FS itself does not account it as used. On devices
> > that have a limitied active zone budget this can lead to premature
> > ENOSPC and/or an exhaustion of active zones.
> > 
> > Fix it in mkfs for new file-systems and also add a check to fsck to find
> > such zones and repair them with '--repair'.
> > 
> > Changes to v1:
> > - fix a bug in fsck where it had a stale return value propagated.
> > 
> > Johannes Thumshirn (2):
> >   btrfs-progs: zoned: refresh stale cached zone state in
> >     btrfs_reset_dev_zone()
> >   btrfs-progs: check: detect leaked active zones on zoned devices
> 
> The build fails on older distros (Centos 8, Leap 15.3/16.0):
> 
>   CC       check/main.o
> check/main.c: In function 'check_zoned_active_zones':
> check/main.c:9220:12: error: 'struct blk_zone' has no member named 'type'
>     if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
>             ^~
> check/main.c:9220:22: error: 'BLK_ZONE_TYPE_CONVENTIONAL' undeclared (first use in this function)
>     if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
>                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
> check/main.c:9220:22: note: each undeclared identifier is reported only once for each function it appears in
> check/main.c:9222:12: error: 'struct blk_zone' has no member named 'cond'
>     if (zone->cond == BLK_ZONE_COND_EMPTY)
>             ^~
> check/main.c:9222:22: error: 'BLK_ZONE_COND_EMPTY' undeclared (first use in this function)
>     if (zone->cond == BLK_ZONE_COND_EMPTY)
>                       ^~~~~~~~~~~~~~~~~~~
> 
> The types were added in f5f2bad67a45 ("block: make the new blkzoned UAPI
> constants discoverable") in 2016 and with the rest of the zoned userspace code
> so it's not something recent.
> 
> I haven't looked what's the problem, this should be reproducible locally using
> the "ci/ci-centos8" scripts (needs docker).

It fails with --disable-zoned, regardless if the zoned headers are
present or complete. Centos 8 build fine with --enable-zoned, I don't
know when it started to work. On Leap 15.3 the header is only partial,
lacks zone capacity, so it must be disabled.

As a fix an #ifdef around check_zoned_active_zones() should work.

Re: [PATCH v2 0/2] btrfs-progs: fix stale active zone after mkfs

[David Sterba]

On Mon, Sep 14, 2026 at 09:55:30PM +0200, David Sterba wrote:
> On Mon, Sep 14, 2026 at 07:40:12PM +0200, David Sterba wrote:
> > On Fri, Sep 04, 2026 at 08:24:42AM +0200, Johannes Thumshirn wrote:
> > > On zoned devices, mkfs can leave a stale zone behind that is used as a
> > > staging area but never reset. This zone is not backed by a chunk or
> > > device extent, so the FS itself does not account it as used. On devices
> > > that have a limitied active zone budget this can lead to premature
> > > ENOSPC and/or an exhaustion of active zones.
> > > 
> > > Fix it in mkfs for new file-systems and also add a check to fsck to find
> > > such zones and repair them with '--repair'.
> > > 
> > > Changes to v1:
> > > - fix a bug in fsck where it had a stale return value propagated.
> > > 
> > > Johannes Thumshirn (2):
> > >   btrfs-progs: zoned: refresh stale cached zone state in
> > >     btrfs_reset_dev_zone()
> > >   btrfs-progs: check: detect leaked active zones on zoned devices
> > 
> > The build fails on older distros (Centos 8, Leap 15.3/16.0):
> > 
> >   CC       check/main.o
> > check/main.c: In function 'check_zoned_active_zones':
> > check/main.c:9220:12: error: 'struct blk_zone' has no member named 'type'
> >     if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
> >             ^~
> > check/main.c:9220:22: error: 'BLK_ZONE_TYPE_CONVENTIONAL' undeclared (first use in this function)
> >     if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
> >                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
> > check/main.c:9220:22: note: each undeclared identifier is reported only once for each function it appears in
> > check/main.c:9222:12: error: 'struct blk_zone' has no member named 'cond'
> >     if (zone->cond == BLK_ZONE_COND_EMPTY)
> >             ^~
> > check/main.c:9222:22: error: 'BLK_ZONE_COND_EMPTY' undeclared (first use in this function)
> >     if (zone->cond == BLK_ZONE_COND_EMPTY)
> >                       ^~~~~~~~~~~~~~~~~~~
> > 
> > The types were added in f5f2bad67a45 ("block: make the new blkzoned UAPI
> > constants discoverable") in 2016 and with the rest of the zoned userspace code
> > so it's not something recent.
> > 
> > I haven't looked what's the problem, this should be reproducible locally using
> > the "ci/ci-centos8" scripts (needs docker).
> 
> It fails with --disable-zoned, regardless if the zoned headers are
> present or complete. Centos 8 build fine with --enable-zoned, I don't
> know when it started to work. On Leap 15.3 the header is only partial,
> lacks zone capacity, so it must be disabled.
> 
> As a fix an #ifdef around check_zoned_active_zones() should work.

Fixed in devel.