Re: Hang in generic/648 on zoned btrfs after aa35dd5cbc06 ("iomap: fix invalid folio access after folio_end_read()")

[Joanne Koong <joannelkoong@gmail.com>]

On Tue, Mar 10, 2026 at 2:08 PM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> On Tue, Mar 10, 2026 at 4:44 AM Johannes Thumshirn
> <Johannes.Thumshirn@wdc.com> wrote:
>
> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> index 867e8ac761c8..03a97361570f 100644
> --- a/fs/iomap/buffered-io.c
> +++ b/fs/iomap/buffered-io.c
> @@ -543,7 +543,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
>                          * helper, then the helper owns the folio and will end
>                          * the read on it.
>                          */
> -                       if (*bytes_submitted == folio_len)
> +                       if (*bytes_submitted == folio_len || !ifs)
>                                 ctx->cur_folio = NULL;
>                 }

it should be this instead:

diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 867e8ac761c8..b803f518adaf 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -497,6 +497,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
        loff_t length = iomap_length(iter);
        struct folio *folio = ctx->cur_folio;
        size_t folio_len = folio_size(folio);
+       struct iomap_folio_state *ifs;
        size_t poff, plen;
        loff_t pos_diff;
        int ret;
@@ -508,7 +509,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
                return iomap_iter_advance(iter, length);
        }

-       ifs_alloc(iter->inode, folio, iter->flags);
+       ifs = ifs_alloc(iter->inode, folio, iter->flags);

        length = min_t(loff_t, length, folio_len - offset_in_folio(folio, pos));
        while (length) {
@@ -543,7 +544,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
                         * helper, then the helper owns the folio and will end
                         * the read on it.
                         */
-                       if (*bytes_submitted == folio_len)
+                       if (*bytes_submitted == folio_len || !ifs)
                                ctx->cur_folio = NULL;
                }

Thanks,
Joanne