reject non-zone aligned RT subvolumes v2

reject non-zone aligned RT subvolumes v2

[Christoph Hellwig]

Hi all,

this rejects not-aligned zoned RT volumes in the SB verifier and in growfs.

Changes since v1:
 - adjust a comment
 - add stable Cc tags

[PATCH 1/2] xfs: validate that zoned RT devices are zone aligned

[Christoph Hellwig]

Garbage collection assumes all zones contain the full amount of blocks.
Mkfs already ensures this happens, but make the kernel check it as well
to avoid getting into trouble due to fuzzers or mkfs bugs.

Fixes: 2167eaabe2fa ("xfs: define the zoned on-disk format")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Cc: <stable@vger.kernel.org> # v6.15
---
 fs/xfs/libxfs/xfs_sb.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index cdd16dd805d7..94c272a2ae26 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -301,6 +301,21 @@ xfs_validate_rt_geometry(
 	    sbp->sb_rbmblocks != xfs_expected_rbmblocks(sbp))
 		return false;
 
+	if (xfs_sb_is_v5(sbp) &&
+	    (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_ZONED)) {
+		uint32_t		mod;
+
+		/*
+		 * Zoned RT devices must be aligned to the RT group size,
+		 * because garbage collection assumes that all zones have the
+		 * same size to avoid insane complexity if that weren't the
+		 * case.
+		 */
+		div_u64_rem(sbp->sb_rextents, sbp->sb_rgextents, &mod);
+		if (mod)
+			return false;
+	}
+
 	return true;
 }
 
-- 
2.47.3

[PATCH 2/2] xfs: fix the zoned RT growfs check for zone alignment

[Christoph Hellwig]

The grofs code for zoned RT subvolums already tries to check for zone
alignment, but gets it wrong by using the old instead of the new mount
structure.

Fixes: 01b71e64bb87 ("xfs: support growfs on zoned file systems")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Cc: <stable@vger.kernel.org> # v6.15
---
 fs/xfs/xfs_rtalloc.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 6907e871fa15..e063f4f2f2e6 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1255,12 +1255,10 @@ xfs_growfs_check_rtgeom(
 	min_logfsbs = min_t(xfs_extlen_t, xfs_log_calc_minimum_size(nmp),
 			nmp->m_rsumblocks * 2);
 
-	kfree(nmp);
-
 	trace_xfs_growfs_check_rtgeom(mp, min_logfsbs);
 
 	if (min_logfsbs > mp->m_sb.sb_logblocks)
-		return -EINVAL;
+		goto out_inval;
 
 	if (xfs_has_zoned(mp)) {
 		uint32_t	gblocks = mp->m_groups[XG_TYPE_RTG].blocks;
@@ -1268,16 +1266,20 @@ xfs_growfs_check_rtgeom(
 
 		if (rextsize != 1)
 			return -EINVAL;
-		div_u64_rem(mp->m_sb.sb_rblocks, gblocks, &rem);
+		div_u64_rem(nmp->m_sb.sb_rblocks, gblocks, &rem);
 		if (rem) {
 			xfs_warn(mp,
 "new RT volume size (%lld) not aligned to RT group size (%d)",
-				mp->m_sb.sb_rblocks, gblocks);
-			return -EINVAL;
+				nmp->m_sb.sb_rblocks, gblocks);
+			goto out_inval;
 		}
 	}
 
+	kfree(nmp);
 	return 0;
+out_inval:
+	kfree(nmp);
+	return -EINVAL;
 }
 
 /*
-- 
2.47.3

reject non-zone aligned RT subvolumes

[Christoph Hellwig]

Hi all,

this rejects not-aligned zoned RT volumes in the SB verifier and in growfs.

Diffstat:
 libxfs/xfs_sb.c |   13 +++++++++++++
 xfs_rtalloc.c   |   14 ++++++++------
 2 files changed, 21 insertions(+), 6 deletions(-)

[PATCH 1/2] xfs: validate that zoned RT devices are zone aligned

[Christoph Hellwig]

Garbage collection assumes all zones contain the full amount of blocks.
Mkfs already ensures this happens, but make the kernel check it as well
to avoid getting into trouble due to fuzzers or mkfs bugs.

Fixes: 2167eaabe2fa ("xfs: define the zoned on-disk format")
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 fs/xfs/libxfs/xfs_sb.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index cdd16dd805d7..db5231f846ea 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -301,6 +301,19 @@ xfs_validate_rt_geometry(
 	    sbp->sb_rbmblocks != xfs_expected_rbmblocks(sbp))
 		return false;
 
+	if (xfs_sb_is_v5(sbp) &&
+	    (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_ZONED)) {
+		uint32_t		mod;
+
+		/*
+		 * Zoned RT devices must be aligned to the rtgroup size, because
+		 * garbage collection can't deal with rump RT groups.
+		 */
+		div_u64_rem(sbp->sb_rextents, sbp->sb_rgextents, &mod);
+		if (mod)
+			return false;
+	}
+
 	return true;
 }
 
-- 
2.47.3

Re: [PATCH 1/2] xfs: validate that zoned RT devices are zone aligned

[Darrick J. Wong]

On Mon, Dec 15, 2025 at 10:48:36AM +0100, Christoph Hellwig wrote:
> Garbage collection assumes all zones contain the full amount of blocks.
> Mkfs already ensures this happens, but make the kernel check it as well
> to avoid getting into trouble due to fuzzers or mkfs bugs.
> 

If this gets merged, please add this so the new requirements are
autobackported to stable:
Cc: <stable@vger.kernel.org> # v6.15

> Fixes: 2167eaabe2fa ("xfs: define the zoned on-disk format")
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
>  fs/xfs/libxfs/xfs_sb.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
> index cdd16dd805d7..db5231f846ea 100644
> --- a/fs/xfs/libxfs/xfs_sb.c
> +++ b/fs/xfs/libxfs/xfs_sb.c
> @@ -301,6 +301,19 @@ xfs_validate_rt_geometry(
>  	    sbp->sb_rbmblocks != xfs_expected_rbmblocks(sbp))
>  		return false;
>  
> +	if (xfs_sb_is_v5(sbp) &&
> +	    (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_ZONED)) {
> +		uint32_t		mod;
> +
> +		/*
> +		 * Zoned RT devices must be aligned to the rtgroup size, because
> +		 * garbage collection can't deal with rump RT groups.

I've decided that I'm ok with imposing this new restriction after the
fact, but only because actual zoned hardware will never expose a runt
group, so the only way you could end up with one now is if you formatted
with zoned=1 without a hardware-zoned storage device.

Could this comment be expanded to say that explicitly?

		/*
		 * Zoned RT devices must be aligned to the rtgroup size,
		 * because garbage collection can't deal with rump RT
		 * groups.  Hardware-zoned storage will never expose a
		 * runt group, so this is only possible with soft-zoned
		 * filesystems, which are not created by default.
		 */

With that change (and a corresponding mkfs enforcement patch),
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D


> +		 */
> +		div_u64_rem(sbp->sb_rextents, sbp->sb_rgextents, &mod);
> +		if (mod)
> +			return false;
> +	}
> +
>  	return true;
>  }
>  
> -- 
> 2.47.3
> 
> 

Re: [PATCH 1/2] xfs: validate that zoned RT devices are zone aligned

[Christoph Hellwig]

On Mon, Dec 15, 2025 at 11:15:06AM -0800, Darrick J. Wong wrote:
> > +	if (xfs_sb_is_v5(sbp) &&
> > +	    (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_ZONED)) {
> > +		uint32_t		mod;
> > +
> > +		/*
> > +		 * Zoned RT devices must be aligned to the rtgroup size, because
> > +		 * garbage collection can't deal with rump RT groups.
> 
> I've decided that I'm ok with imposing this new restriction after the
> fact, but only because actual zoned hardware will never expose a runt
> group, so the only way you could end up with one now is if you formatted
> with zoned=1 without a hardware-zoned storage device.
> 
> Could this comment be expanded to say that explicitly?

That comment would not actually be true.  The hardware specs do allow
for runt zones.  No shipping hardware that I know of does that, and
mkfs protects against it, but the statement would be at best misleading
if not outright wrong.  The real reason why this is fine is because
mkfs rounds the capacity down to the zone size.

Re: [PATCH 1/2] xfs: validate that zoned RT devices are zone aligned

[Darrick J. Wong]

On Tue, Dec 16, 2025 at 06:10:02AM +0100, Christoph Hellwig wrote:
> On Mon, Dec 15, 2025 at 11:15:06AM -0800, Darrick J. Wong wrote:
> > > +	if (xfs_sb_is_v5(sbp) &&
> > > +	    (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_ZONED)) {
> > > +		uint32_t		mod;
> > > +
> > > +		/*
> > > +		 * Zoned RT devices must be aligned to the rtgroup size, because
> > > +		 * garbage collection can't deal with rump RT groups.
> > 
> > I've decided that I'm ok with imposing this new restriction after the
> > fact, but only because actual zoned hardware will never expose a runt
> > group, so the only way you could end up with one now is if you formatted
> > with zoned=1 without a hardware-zoned storage device.
> > 
> > Could this comment be expanded to say that explicitly?
> 
> That comment would not actually be true.  The hardware specs do allow
> for runt zones.

Bah.  That figures. :(

> No shipping hardware that I know of does that, and
> mkfs protects against it, but the statement would be at best misleading
> if not outright wrong.  The real reason why this is fine is because
> mkfs rounds the capacity down to the zone size.

"...garbage collection won't deal with rump RT groups because the size
increase isn't worth the corner case complexity.", then? :D

--D