Re: Hang in generic/648 on zoned btrfs after aa35dd5cbc06 ("iomap: fix invalid folio access after folio_end_read()")

[Joanne Koong <joannelkoong@gmail.com>]

On Tue, Mar 17, 2026 at 2:35 AM Johannes Thumshirn
<Johannes.Thumshirn@wdc.com> wrote:
>
> On 3/10/26 10:55 PM, Joanne Koong wrote:
> > On Tue, Mar 10, 2026 at 2:08 PM Joanne Koong <joannelkoong@gmail.com> wrote:
> >> On Tue, Mar 10, 2026 at 4:44 AM Johannes Thumshirn
> >> <Johannes.Thumshirn@wdc.com> wrote:
> >>
> >> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> >> index 867e8ac761c8..03a97361570f 100644
> >> --- a/fs/iomap/buffered-io.c
> >> +++ b/fs/iomap/buffered-io.c
> >> @@ -543,7 +543,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
> >>                           * helper, then the helper owns the folio and will end
> >>                           * the read on it.
> >>                           */
> >> -                       if (*bytes_submitted == folio_len)
> >> +                       if (*bytes_submitted == folio_len || !ifs)
> >>                                  ctx->cur_folio = NULL;
> >>                  }
> > it should be this instead:
> >
> > diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> > index 867e8ac761c8..b803f518adaf 100644
> > --- a/fs/iomap/buffered-io.c
> > +++ b/fs/iomap/buffered-io.c
> > @@ -497,6 +497,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
> >          loff_t length = iomap_length(iter);
> >          struct folio *folio = ctx->cur_folio;
> >          size_t folio_len = folio_size(folio);
> > +       struct iomap_folio_state *ifs;
> >          size_t poff, plen;
> >          loff_t pos_diff;
> >          int ret;
> > @@ -508,7 +509,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
> >                  return iomap_iter_advance(iter, length);
> >          }
> >
> > -       ifs_alloc(iter->inode, folio, iter->flags);
> > +       ifs = ifs_alloc(iter->inode, folio, iter->flags);
> >
> >          length = min_t(loff_t, length, folio_len - offset_in_folio(folio, pos));
> >          while (length) {
> > @@ -543,7 +544,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
> >                           * helper, then the helper owns the folio and will end
> >                           * the read on it.
> >                           */
> > -                       if (*bytes_submitted == folio_len)
> > +                       if (*bytes_submitted == folio_len || !ifs)
> >                                  ctx->cur_folio = NULL;
> >                  }
> >
> > Thanks,
> > Joanne
> >
> This version is making the test pass again,
>
> Reported-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
>
> Tested-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
>
> Thanks a lot for this!
>

Thanks for reporting this and testing / helping to debug the issue.
I'll submit the fix for this upstream today.

Thanks,
Joanne