[PATCH] nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

[Guixin Liu]

在 2026/9/15 14:36, Christoph Hellwig 写道:
> On Mon, Sep 14, 2026 at 06:57:13PM +0800, Guixin Liu wrote:
>> The namespace head is marked zoned at allocation time based only on
>> the command set identifier, before any zone information has been
>> queried.  If the zone info query fails on the first scan, the path
>> namespace is registered without zoned limits while the head still
>> advertises the zoned capability with a zone size of zero.  Reporting
>> zones or writing to the head then shifts by ilog2(0), triggering the
>> UBSAN shift-out-of-bounds report in the report-zones and write paths.
>>
>> Drop the zoned feature from the head allocation and inherit it from
>> the path namespace: the head limits refresh already stacks the zoned
>> feature, the zone size and the zone resource limits from the path
>> queue, so the head matches the path namespace and becomes zoned once a
>> revalidation succeeds.  This also stops marking the head zoned when
>> CONFIG_BLK_DEV_ZONED is off, which used to fail the head allocation
>> with a WARN.
> Where do we actually stack it right now?
The head stacks it in nvme_update_ns_info(): after the path namespace
update it's own limits, queue_limits_stack_bdev() stacks the path
queue into the head, and blk_stack_limits() inherits the BLK_FEAT_ZONED
through BLK_FEAT_INHERIT_MASK, along with chunk_sectors and the zone
resource limits. That happens before the head is registered, so
blk_revalidate_disk_zones() see the zoned feature in place.

Best Regards,
Guixin Liu