Re: [PATCH 1/2] fuse2fs: mount norecovery if main block device is readonly

[Dave Dykstra <dwd@cern.ch>]

On Fri, Oct 17, 2025 at 12:38:41PM -0700, Darrick J. Wong wrote:
> On Thu, Oct 16, 2025 at 02:34:18PM -0500, Dave Dykstra wrote:
...
> > > +		err_printf(ff, "%s.\n",
> > > +			   _("read-only device, trying to mount norecovery"));
> > > +		flags &= ~EXT2_FLAG_RW;
> > > +		ff->ro = 1;
> > > +		ff->norecovery = 1;
> > 
> > I don't think it's good to switch to read-only+norecovery even when a
> > read-write mode was requested.  That goes too far.
> 
> The block device cannot be opened for write, so the mount cannot allow
> user programs to write to files, and the fs driver cannot recover the
> journal and it cannot write to the disk.  The only other choice would
> be to fail the mount.

Yes, I think it's better to fail the mount if recovery is needed and it
can't be done.

> norecovery is wrong though.  The kernel fails the mount if the journal
> needs recovery, the block device is ro, and the user didn't specify
> norecovery.

That makes more sense.

> > It also doesn't catch when recovery is needed.
> 
> What specifically do you mean "catch when recovery is needed"?  68 lines
> down from the ext2fs_open2 call is a check for the needsrecovery state,
> followed by recovering the journal.

I meant that it should fail in that case because it can't recover.

> > My proposed patch only reopens read-only
> > when ro was requested and then later checks to see if recovery is needed
> > and if so, errors out.
> 
> Your patch also didn't re-check the feature support after reopening the
> block device, which you dismissed even though that can lead to
> catastrophic behavior.

In this version of the patch there is no reopening, there is only a
switch to open without RW if the RW open fails.  So all feature checks
happen after it.

Dave