[PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Guixin Liu]

The namespace head is marked zoned at allocation time based only on
the command set identifier, before any zone information has been
queried.  If the zone info query fails on the first scan, the path
namespace is registered without zoned limits while the head still
advertises the zoned capability with a zone size of zero.  Reporting
zones or writing to the head then shifts by ilog2(0), triggering the
UBSAN shift-out-of-bounds report in the report-zones and write paths.

Drop the zoned feature from the head allocation and inherit it from
the path namespace: the head limits refresh already stacks the zoned
feature, the zone size and the zone resource limits from the path
queue, so the head matches the path namespace and becomes zoned once a
revalidation succeeds.  This also stops marking the head zoned when
CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
with a WARN.

Found by code inspection while reviewing the nvme-7.3 branch.

Tested with a null_blk zoned namespace exported over two nvmet-tcp
ports, with the target patched to fail the command set specific
identify: the head no longer comes up zoned with zone size 0, the
UBSAN report is gone, and an ns-rescan once the identify succeeds again
transitions the head to zoned with the correct zone size.

Fixes: 28982ad73d6a ("nvme: set BLK_FEAT_ZONED for ZNS multipath disks")
Fixes: 3838e80fcfb3 ("nvme: skip the zoned limits update if the zone info query failed")
Cc: stable@vger.kernel.org
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/nvme/host/multipath.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 75dbb58286a3..cdfaa04c25f8 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -763,8 +763,6 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
 	lim.dma_alignment = 3;
 	lim.features |= BLK_FEAT_IO_STAT | BLK_FEAT_NOWAIT |
 		BLK_FEAT_POLL | BLK_FEAT_ATOMIC_WRITES | BLK_FEAT_PCI_P2PDMA;
-	if (head->ids.csi == NVME_CSI_ZNS)
-		lim.features |= BLK_FEAT_ZONED;
 
 	head->disk = blk_alloc_disk(&lim, ctrl->numa_node);
 	if (IS_ERR(head->disk))
-- 
2.43.7

Re: [PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Christoph Hellwig]

On Mon, Sep 14, 2026 at 06:57:13PM +0800, Guixin Liu wrote:
> The namespace head is marked zoned at allocation time based only on
> the command set identifier, before any zone information has been
> queried.  If the zone info query fails on the first scan, the path
> namespace is registered without zoned limits while the head still
> advertises the zoned capability with a zone size of zero.  Reporting
> zones or writing to the head then shifts by ilog2(0), triggering the
> UBSAN shift-out-of-bounds report in the report-zones and write paths.
> 
> Drop the zoned feature from the head allocation and inherit it from
> the path namespace: the head limits refresh already stacks the zoned
> feature, the zone size and the zone resource limits from the path
> queue, so the head matches the path namespace and becomes zoned once a
> revalidation succeeds.  This also stops marking the head zoned when
> CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
> with a WARN.

Where do we actually stack it right now?

Re: [PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Guixin Liu]

在 2026/9/15 14:36, Christoph Hellwig 写道:
> On Mon, Sep 14, 2026 at 06:57:13PM +0800, Guixin Liu wrote:
>> The namespace head is marked zoned at allocation time based only on
>> the command set identifier, before any zone information has been
>> queried.  If the zone info query fails on the first scan, the path
>> namespace is registered without zoned limits while the head still
>> advertises the zoned capability with a zone size of zero.  Reporting
>> zones or writing to the head then shifts by ilog2(0), triggering the
>> UBSAN shift-out-of-bounds report in the report-zones and write paths.
>>
>> Drop the zoned feature from the head allocation and inherit it from
>> the path namespace: the head limits refresh already stacks the zoned
>> feature, the zone size and the zone resource limits from the path
>> queue, so the head matches the path namespace and becomes zoned once a
>> revalidation succeeds.  This also stops marking the head zoned when
>> CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
>> with a WARN.
> Where do we actually stack it right now?
The head stacks it in nvme_update_ns_info(): after the path namespace
update it's own limits, queue_limits_stack_bdev() stacks the path
queue into the head, and blk_stack_limits() inherits the BLK_FEAT_ZONED
through BLK_FEAT_INHERIT_MASK, along with chunk_sectors and the zone
resource limits. That happens before the head is registered, so
blk_revalidate_disk_zones() see the zoned feature in place.

Best Regards,
Guixin Liu

Re: [PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Guixin Liu]

在 2026/9/15 16:51, Guixin Liu 写道:
>
>
> 在 2026/9/15 14:36, Christoph Hellwig 写道:
>> On Mon, Sep 14, 2026 at 06:57:13PM +0800, Guixin Liu wrote:
>>> The namespace head is marked zoned at allocation time based only on
>>> the command set identifier, before any zone information has been
>>> queried.  If the zone info query fails on the first scan, the path
>>> namespace is registered without zoned limits while the head still
>>> advertises the zoned capability with a zone size of zero.  Reporting
>>> zones or writing to the head then shifts by ilog2(0), triggering the
>>> UBSAN shift-out-of-bounds report in the report-zones and write paths.
>>>
>>> Drop the zoned feature from the head allocation and inherit it from
>>> the path namespace: the head limits refresh already stacks the zoned
>>> feature, the zone size and the zone resource limits from the path
>>> queue, so the head matches the path namespace and becomes zoned once a
>>> revalidation succeeds.  This also stops marking the head zoned when
>>> CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
>>> with a WARN.
>> Where do we actually stack it right now?
> The head stacks it in nvme_update_ns_info(): after the path namespace
> update it's own limits, queue_limits_stack_bdev() stacks the path
> queue into the head, and blk_stack_limits() inherits the BLK_FEAT_ZONED
> through BLK_FEAT_INHERIT_MASK, along with chunk_sectors and the zone
> resource limits. That happens before the head is registered, so
> blk_revalidate_disk_zones() see the zoned feature in place.
>
Hi Christoph, any feedback?

Best Regards,
Guixin Liu
> Best Regards,
> Guixin Liu

Re: [PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Keith Busch]

On Mon, Sep 14, 2026 at 06:57:13PM +0800, Guixin Liu wrote:
> The namespace head is marked zoned at allocation time based only on
> the command set identifier, before any zone information has been
> queried.  If the zone info query fails on the first scan, the path
> namespace is registered without zoned limits while the head still
> advertises the zoned capability with a zone size of zero.  Reporting
> zones or writing to the head then shifts by ilog2(0), triggering the
> UBSAN shift-out-of-bounds report in the report-zones and write paths.
> 
> Drop the zoned feature from the head allocation and inherit it from
> the path namespace: the head limits refresh already stacks the zoned
> feature, the zone size and the zone resource limits from the path
> queue, so the head matches the path namespace and becomes zoned once a
> revalidation succeeds.  This also stops marking the head zoned when
> CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
> with a WARN.

Looks correct to me. Applied to nvme-7.3.