[PATCH 0/2] ntfs: super.c fixes for MFT mirror check and sync_fs

[PATCH 0/2] ntfs: super.c fixes for MFT mirror check and sync_fs

[DaeMyung Kang]

This series fixes two regressions in fs/ntfs/super.c introduced by:

  6251f0b0de7d ("ntfs: update super block operations")

which switched the driver to the fs_context-based mount API and added
->sync_fs.

Patch 1 restores the missing memcmp() inside check_mft_mirror().  The
function still walks both $MFT and $MFTMirr records and computes a
per-record byte count to compare, but the actual comparison was dropped
when super block operations were updated.  As a result, mount silently
accepts a stale or inconsistent $MFTMirr as long as both records pass
the structural baad-record checks, defeating the purpose of having the
mirror.  With the comparison restored, a mismatch is reported at mount
time and the existing on_errors policy decides whether to convert to
read-only or proceed with NVolErrors set.

Patch 2 stops ntfs_sync_fs() from clearing VOLUME_IS_DIRTY.  sync_fs
can be called while the filesystem is still mounted read-write (for
example via sync(2) or periodic writeback), so clearing the dirty bit
there marks the volume clean before the mount lifetime has ended.  If
the system crashes after sync_fs() but before unmount or remount-ro,
the on-disk image is left looking cleanly shut down even though it is
not.  The legitimate clear paths in ntfs_put_super() and the RW->RO
remount path are kept intact and gate on !NVolErrors().

Both patches apply on top of ntfs-next.

DaeMyung Kang (2):
  ntfs: restore $MFT mirror contents check
  ntfs: do not mark the volume clean from sync_fs

 fs/ntfs/super.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

-- 
2.43.0

[PATCH 1/2] ntfs: restore $MFT mirror contents check

[DaeMyung Kang]

check_mft_mirror() still computes the number of bytes to validate in each
mirrored MFT record, but the actual comparison against $MFTMirr was dropped
when the superblock code was updated.

As a result, mount misses a stale or inconsistent $MFTMirr as long as both
records pass the structural baad-record checks. Restore the comparison and
log an error when the primary $MFT record differs from its mirror copy.

Returning false lets the existing mount error handling mark the volume as
having NTFS errors and, with on_errors=remount-ro, continue read-only. The
default on_errors=continue mount policy still allows the mount to proceed.

Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 fs/ntfs/super.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 22dc786..e8ecc52 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -979,6 +979,13 @@ mft_unmap_out:
 			    ntfs_is_baad_recordp((__le32 *)kmirr))
 				bytes = vol->mft_record_size;
 		}
+		/* Compare the two records. */
+		if (memcmp(kmft, kmirr, bytes)) {
+			ntfs_error(sb,
+				   "$MFT and $MFTMirr record %i do not match.  Run chkdsk.",
+				   i);
+			goto mm_unmap_out;
+		}
 		kmft += vol->mft_record_size;
 		kmirr += vol->mft_record_size;
 	} while (++i < vol->mftmirr_size);
-- 
2.43.0

[PATCH 2/2] ntfs: do not mark the volume clean from sync_fs

[DaeMyung Kang]

ntfs_sync_fs() can be called while the filesystem remains mounted
read-write, for example by sync(2) or periodic writeback. Clearing
VOLUME_IS_DIRTY from that path marks the volume clean before the mount
lifetime has ended.

If the system crashes after sync_fs() clears the bit but before unmount or
remount-read-only, the volume can be left looking clean even though a clean
shutdown did not happen. Keep the dirty bit set during sync_fs(); the
unmount and remount-read-only paths already clear it when no NTFS errors
were seen.

Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 fs/ntfs/super.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index e8ecc52..024d363 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1895,7 +1895,6 @@ static void ntfs_shutdown(struct super_block *sb)
 static int ntfs_sync_fs(struct super_block *sb, int wait)
 {
 	struct ntfs_volume *vol = NTFS_SB(sb);
-	int err = 0;
 
 	if (NVolShutdown(vol))
 		return -EIO;
@@ -1903,15 +1902,10 @@ static int ntfs_sync_fs(struct super_block *sb, int wait)
 	if (!wait)
 		return 0;
 
-	/* If there are some dirty buffers in the bdev inode */
-	if (ntfs_clear_volume_flags(vol, VOLUME_IS_DIRTY)) {
-		ntfs_warning(sb, "Failed to clear dirty bit in volume information flags.  Run chkdsk.");
-		err = -EIO;
-	}
 	sync_inodes_sb(sb);
 	sync_blockdev(sb->s_bdev);
 	blkdev_issue_flush(sb->s_bdev);
-	return err;
+	return 0;
 }
 
 /*
-- 
2.43.0

Re: [PATCH 2/2] ntfs: do not mark the volume clean from sync_fs

[Namjae Jeon]

On Mon, May 11, 2026 at 2:11 AM DaeMyung Kang <charsyam@gmail.com> wrote:
>
> ntfs_sync_fs() can be called while the filesystem remains mounted
> read-write, for example by sync(2) or periodic writeback. Clearing
> VOLUME_IS_DIRTY from that path marks the volume clean before the mount
> lifetime has ended.
>
> If the system crashes after sync_fs() clears the bit but before unmount or
> remount-read-only, the volume can be left looking clean even though a clean
> shutdown did not happen. Keep the dirty bit set during sync_fs(); the
> unmount and remount-read-only paths already clear it when no NTFS errors
> were seen.
>
> Fixes: 6251f0b0de7d ("ntfs: update super block operations")
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
The VOLUME_IS_DIRTY flag is set just before write operations. Once
those changes are safely flushed to disk, I think that it should be
reasonable to clear the dirty bit. That said, because many users
generally tend to simply unplug USB drives without unmounting,
clearing it only in the unmount paths causes unnecessary warnings and
chkdsk suggestions on the next mount, even when there is no actual
corruption.

Thanks.

Re: [PATCH 1/2] ntfs: restore $MFT mirror contents check

[Namjae Jeon]

On Mon, May 11, 2026 at 2:11 AM DaeMyung Kang <charsyam@gmail.com> wrote:
>
> check_mft_mirror() still computes the number of bytes to validate in each
> mirrored MFT record, but the actual comparison against $MFTMirr was dropped
> when the superblock code was updated.
>
> As a result, mount misses a stale or inconsistent $MFTMirr as long as both
> records pass the structural baad-record checks. Restore the comparison and
> log an error when the primary $MFT record differs from its mirror copy.
>
> Returning false lets the existing mount error handling mark the volume as
> having NTFS errors and, with on_errors=remount-ro, continue read-only. The
> default on_errors=continue mount policy still allows the mount to proceed.
>
> Fixes: 6251f0b0de7d ("ntfs: update super block operations")
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Applied it to #ntfs-next.
Thanks!