From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794046367; b=3PUdYkU+ses90zGzmzkagSBmX3JLcPW7wcHR3Np+PATyqdCXLivaX+0g4LV3CvDsHcx2 OPsRAQgs4mEcp+Xa3nqckG72YHb3dU88ZbhglTtgkx0Fz3bJrrwJYv8hMv2NH/a1OKmpM 8ge/v69l8wEe0jki4MiXEloXwuTO536UEWPlW4fCNxsLyRDZ5RBCZuWaARedlYbpL83SJ MGH/y4UVUX1D2Gl17Lgz/UTUIkG3Jrgkq3YihU+CccsMFgIuGMOSOCE3B/YifAgbEnWR1 sheDGrGI9Fphz0xh0q5yomVcTb9Ru8217gIDKjkqytc93oMYG+g+cyTvAiIpcN/RsFQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794046367; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=s++dTWiZuxiMwAtfiHpS0ww7B07PNwXrgrQm7NKqFAQ=; b=PxGmtOn3Jxkmap0DHzR6BQGr6IqSM1eSOWc7JdeNGSKtUWFRd4HJWjfp6hoMI6n01vIw mLhNx4JtNer9SBQMpTsxGDcN0p8YcujjpmxhQCrckK2tQpwracOF008UlyVUNNXoeFZdE ocfXnK839uELH1ewwVo0XgmFf5kVFp2mqvBjx48YQOEnOz4IsJ6eoQOEpxY6AiGCniMz/ QVHAKVcT2XIwhD/KPTFZXNi7cc3NkqFUfcCtWyJCJmpM8lcugxVtV76HbjQzWDhiQtgAV 260C1YN3UP/hbAqvrQg9GR9egQ5g26SeonqhLkqPd9m0Rn4gC/MHyqYnEBxDFYMY2Lw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=YrQcA1uC; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A1BF606A326 for ; Sat, 7 Nov 2026 10:12:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=YrQcA1uC Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F0D81F0089F; Sat, 7 Nov 2026 10:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794046367; bh=s++dTWiZuxiMwAtfiHpS0ww7B07PNwXrgrQm7NKqFAQ=; h=From:To:Cc:Subject:Date; b=YrQcA1uCq6+fBJph98yxaPJiz8Tpo1RcIC6DjM/joyy8pUQv4RctcwFitcoHDgU4p mT+4FyJT6itbNB9zX+5ODQOlq15hc+uPfUbNzyZ34sW2YsEsxCrm0GuKSheX1hT4w6 maT/csui+A27EmYkSORzgDsU+cp5jkvQz2norMj0b0skQZw0FxfddLYxgovQKPr/bN Ked79vXQr0jM4b/YPeHVBGPLuoxbCwtSwfPSzbVnrQe9wgIFO1/8UeLhVmvwY1NS1j eW6qUdwF4axmrGhtnU4arNWKgusHsfOYmmWXuMCm5qv7HHl4VebWNMcUdANRBQYX5g +SiPyZ5wVJrLQ== From: Sasha Levin To: zenghongling@kylinos.cn, hyc.lee@gmail.com, liubaolin@kylinos.cn, linkinjeon@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] ntfs: fix volume flag update races" failed to apply to 6.18-stable tree Date: Sat, 7 Nov 2026 05:12:45 -0500 Message-ID: <20261107051245-failed-6.18-56a64ee0f99d@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 56a64ee0f99d4ca1756cf743f951c110d39401e5 # git commit -s git send-email --to '' --in-reply-to '20261107051245-failed-6.18-56a64ee0f99d@kernel.org' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 56a64ee0f99d4ca1756cf743f951c110d39401e5 Mon Sep 17 00:00:00 2001 From: Hongling Zeng Date: Tue, 15 Sep 2026 16:32:46 +0800 Subject: [PATCH] ntfs: fix volume flag update races ntfs_set_volume_flags() and ntfs_clear_volume_flags() both read vol->vol_flags outside any lock to compute the new value before handing it to ntfs_write_volume_flags(), which only takes ni->mrec_lock around the actual write. The read-modify-write is therefore not atomic, and two concurrent callers can lose an update: ntfs_sync_fs() may derive a "clean" value from vol->vol_flags while a writer concurrently records an error and sets VOLUME_IS_DIRTY; the locked write then silently overwrites the freshly-set dirty bit. The on-disk volume looks clean despite the recorded errors, so chkdsk will not run on the next mount and corrupted metadata can persist. Fix by moving the read-modify-write inside the mrec_lock: pass the bits to set and to clear separately, and combine them with the current flag state under the lock inside ntfs_write_volume_flags(). The set/clear helpers pass only the bits to modify, not the complete flag state. The bit manipulation is done on CPU-endian values, and the result is converted back to little-endian before storing it. The wrappers keep their signatures so callers are unchanged. Cc: stable@vger.kernel.org Signed-off-by: Hongling Zeng Reviewed-by: Hyunchul Lee Reviewed-by: Baolin Liu Signed-off-by: Namjae Jeon --- fs/ntfs/super.c | 63 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 45 insertions(+), 18 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index f7b3140049c40..5c71aaa0e25d5 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -360,31 +360,45 @@ void ntfs_handle_error(struct super_block *sb) } /* - * ntfs_write_volume_flags - write new flags to the volume information flags + * ntfs_write_volume_flags - apply flag changes to the volume information flags * @vol: ntfs volume on which to modify the flags - * @flags: new flags value for the volume information flags + * @set_bits: bits to set in the volume information flags + * @clear_bits: bits to clear in the volume information flags * * Internal function. You probably want to use ntfs_{set,clear}_volume_flags() * instead (see below). * - * Replace the volume information flags on the volume @vol with the value - * supplied in @flags. Note, this overwrites the volume information flags, so - * make sure to combine the flags you want to modify with the old flags and use - * the result when calling ntfs_write_volume_flags(). + * Combine @set_bits and @clear_bits with the current in-memory flag state and + * write the result back. The set/clear helpers pass only the bits to modify, + * not the complete flag state. The read-modify-write happens under + * ni->mrec_lock so that concurrent set/clear operations cannot lose updates. + * All bit manipulation is done on CPU-endian values, and the result is + * converted back to little-endian before storing it. * * Return 0 on success and -errno on error. */ -static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags) +static int ntfs_write_volume_flags(struct ntfs_volume *vol, + const __le16 set_bits, const __le16 clear_bits, + const bool skip_if_errors) { struct ntfs_inode *ni = NTFS_I(vol->vol_ino); struct volume_information *vi; struct ntfs_attr_search_ctx *ctx; + u16 flags; int err; - ntfs_debug("Entering, old flags = 0x%x, new flags = 0x%x.", - le16_to_cpu(vol->vol_flags), le16_to_cpu(flags)); mutex_lock(&ni->mrec_lock); - if (vol->vol_flags == flags) + + if (skip_if_errors && NVolErrors(vol)) + goto done; + + flags = le16_to_cpu(vol->vol_flags); + flags |= le16_to_cpu(set_bits) & le16_to_cpu(VOLUME_FLAGS_MASK); + flags &= ~(le16_to_cpu(clear_bits) & le16_to_cpu(VOLUME_FLAGS_MASK)); + ntfs_debug("Entering, old flags = 0x%x, new flags = 0x%x.", + le16_to_cpu(vol->vol_flags), flags); + + if (le16_to_cpu(vol->vol_flags) == flags) goto done; ctx = ntfs_attr_get_search_ctx(ni, NULL); @@ -400,7 +414,7 @@ static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags) vi = (struct volume_information *)((u8 *)ctx->attr + le16_to_cpu(ctx->attr->data.resident.value_offset)); - vol->vol_flags = vi->flags = flags; + vol->vol_flags = vi->flags = cpu_to_le16(flags); mark_mft_record_dirty(ctx->ntfs_ino); ntfs_attr_put_search_ctx(ctx); done: @@ -421,13 +435,14 @@ static int ntfs_write_volume_flags(struct ntfs_volume *vol, const __le16 flags) * @flags: flags to set on the volume * * Set the bits in @flags in the volume information flags on the volume @vol. + * The bits are combined with the current flag state under the lock in + * ntfs_write_volume_flags(), so concurrent updates are not lost. * * Return 0 on success and -errno on error. */ int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags) { - flags &= VOLUME_FLAGS_MASK; - return ntfs_write_volume_flags(vol, vol->vol_flags | flags); + return ntfs_write_volume_flags(vol, flags, 0, false); } /* @@ -436,14 +451,27 @@ int ntfs_set_volume_flags(struct ntfs_volume *vol, __le16 flags) * @flags: flags to clear on the volume * * Clear the bits in @flags in the volume information flags on the volume @vol. + * The bits are combined with the current flag state under the lock in + * ntfs_write_volume_flags(), so concurrent updates are not lost. * * Return 0 on success and -errno on error. */ int ntfs_clear_volume_flags(struct ntfs_volume *vol, __le16 flags) { - flags &= VOLUME_FLAGS_MASK; - flags = vol->vol_flags & cpu_to_le16(~le16_to_cpu(flags)); - return ntfs_write_volume_flags(vol, flags); + return ntfs_write_volume_flags(vol, 0, flags, false); +} + +/* + * ntfs_clear_volume_dirty_if_no_errors - clear dirty bit if no errors exist + * @vol: ntfs volume whose dirty bit should be cleared + * + * Check NVolErrors() and clear VOLUME_IS_DIRTY under the same mrec_lock so + * ntfs_sync_fs() cannot clear the dirty bit after a concurrent error has been + * recorded. + */ +static int ntfs_clear_volume_dirty_if_no_errors(struct ntfs_volume *vol) +{ + return ntfs_write_volume_flags(vol, 0, VOLUME_IS_DIRTY, true); } int ntfs_write_volume_label(struct ntfs_volume *vol, char *label) @@ -1926,8 +1954,7 @@ static int ntfs_sync_fs(struct super_block *sb, int wait) return 0; /* If there are some dirty buffers in the bdev inode */ - if (!NVolErrors(vol) && - ntfs_clear_volume_flags(vol, VOLUME_IS_DIRTY)) { + if (ntfs_clear_volume_dirty_if_no_errors(vol)) { ntfs_warning(sb, "Failed to clear dirty bit in volume information flags. Run chkdsk."); err = -EIO; } -- 2.53.0