This is a note to let you know that I've just added the patch titled sd: Fix REQ_OP_ZONE_REPORT completion handling to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: sd-fix-req_op_zone_report-completion-handling.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From masato.suzuki@xxxxxxx Tue Jan 28 09:03:58 2020 From: Masato Suzuki <masato.suzuki@xxxxxxx> Date: Mon, 27 Jan 2020 14:07:46 +0900 Subject: sd: Fix REQ_OP_ZONE_REPORT completion handling To: stable@xxxxxxxxxxxxxxx, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>, linux-scsi@xxxxxxxxxxxxxxx, "Martin K . Petersen" <martin.petersen@xxxxxxxxxx> Cc: Damien Le Moal <damien.lemoal@xxxxxxx> Message-ID: <20200127050746.136440-1-masato.suzuki@xxxxxxx> From: Masato Suzuki <masato.suzuki@xxxxxxx> ZBC/ZAC report zones command may return less bytes than requested if the number of matching zones for the report request is small. However, unlike read or write commands, the remainder of incomplete report zones commands cannot be automatically requested by the block layer: the start sector of the next report cannot be known, and the report reply may not be 512B aligned for SAS drives (a report zone reply size is always a multiple of 64B). The regular request completion code executing bio_advance() and restart of the command remainder part currently causes invalid zone descriptor data to be reported to the caller if the report zone size is smaller than 512B (a case that can happen easily for a report of the last zones of a SAS drive for example). Since blkdev_report_zones() handles report zone command processing in a loop until completion (no more zones are being reported), we can safely avoid that the block layer performs an incorrect bio_advance() call and restart of the remainder of incomplete report zone BIOs. To do so, always indicate a full completion of REQ_OP_ZONE_REPORT by setting good_bytes to the request buffer size and by setting the command resid to 0. This does not affect the post processing of the report zone reply done by sd_zbc_complete() since the reply header indicates the number of zones reported. Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Cc: <stable@xxxxxxxxxxxxxxx> # 4.19 Cc: <stable@xxxxxxxxxxxxxxx> # 4.14 Signed-off-by: Masato Suzuki <masato.suzuki@xxxxxxx> Reviewed-by: Damien Le Moal <damien.lemoal@xxxxxxx> Acked-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/scsi/sd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -1981,9 +1981,13 @@ static int sd_done(struct scsi_cmnd *SCp } break; case REQ_OP_ZONE_REPORT: + /* To avoid that the block layer performs an incorrect + * bio_advance() call and restart of the remainder of + * incomplete report zone BIOs, always indicate a full + * completion of REQ_OP_ZONE_REPORT. + */ if (!result) { - good_bytes = scsi_bufflen(SCpnt) - - scsi_get_resid(SCpnt); + good_bytes = scsi_bufflen(SCpnt); scsi_set_resid(SCpnt, 0); } else { good_bytes = 0; Patches currently in stable-queue which might be from masato.suzuki@xxxxxxx are queue-4.14/sd-fix-req_op_zone_report-completion-handling.patch