[PATCH] ntfs: fail attrlist updates when the superblock is inactive

[PATCH] ntfs: fail attrlist updates when the superblock is inactive

[Peiyang He]

generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes.
If eviction selects the fake inode for a base inode's unnamed
$ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's
reference on the base inode while the fake inode is still hashed and marked
I_FREEING.

That iput can synchronously write back the base inode. The writeback path
may update mapping pairs and call ntfs_attrlist_update(), which
unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake
inode. VFS then finds the I_FREEING inode and waits for eviction to finish,
but the current task is still inside that eviction path, causing a
self-deadlock in find_inode().

Fix this by mirroring the teardown guard used by __ntfs_write_inode():
once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode. 
Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.

Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Closes: https://lore.kernel.org/all/AB8D5E603E6EA856+ae5f622a-dd3a-4e38-bdd2-42276ae0e1a8@smail.nju.edu.cn/
Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Assisted-by: Codex:gpt-5.5
---
 fs/ntfs/attrlist.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index afb13038ba42..1658cbe1fa59 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -57,6 +57,9 @@ int ntfs_attrlist_update(struct ntfs_inode *base_ni)
 	struct ntfs_inode *attr_ni;
 	int err;
 
+	if (!(VFS_I(base_ni)->i_sb->s_flags & SB_ACTIVE))
+		return -EIO;
+
 	attr_vi = ntfs_attr_iget(VFS_I(base_ni), AT_ATTRIBUTE_LIST, AT_UNNAMED, 0);
 	if (IS_ERR(attr_vi)) {
 		err = PTR_ERR(attr_vi);

base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
-- 
2.43.0

Re: [PATCH] ntfs: fail attrlist updates when the superblock is inactive

[Hyunchul Lee]

2026년 7월 3일 (금) 오후 2:46, Peiyang He <peiyang_he@smail.nju.edu.cn>님이 작성:
>
> generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes.
> If eviction selects the fake inode for a base inode's unnamed
> $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's
> reference on the base inode while the fake inode is still hashed and marked
> I_FREEING.
>
> That iput can synchronously write back the base inode. The writeback path
> may update mapping pairs and call ntfs_attrlist_update(), which
> unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake
> inode. VFS then finds the I_FREEING inode and waits for eviction to finish,
> but the current task is still inside that eviction path, causing a
> self-deadlock in find_inode().
>
> Fix this by mirroring the teardown guard used by __ntfs_write_inode():
> once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode.
> Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.
>
> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Closes: https://lore.kernel.org/all/AB8D5E603E6EA856+ae5f622a-dd3a-4e38-bdd2-42276ae0e1a8@smail.nju.edu.cn/
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>

Could you add some comments?
Other than that, it looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> Assisted-by: Codex:gpt-5.5
> ---
>  fs/ntfs/attrlist.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
> index afb13038ba42..1658cbe1fa59 100644
> --- a/fs/ntfs/attrlist.c
> +++ b/fs/ntfs/attrlist.c
> @@ -57,6 +57,9 @@ int ntfs_attrlist_update(struct ntfs_inode *base_ni)
>         struct ntfs_inode *attr_ni;
>         int err;
>
> +       if (!(VFS_I(base_ni)->i_sb->s_flags & SB_ACTIVE))
> +               return -EIO;
> +
>         attr_vi = ntfs_attr_iget(VFS_I(base_ni), AT_ATTRIBUTE_LIST, AT_UNNAMED, 0);
>         if (IS_ERR(attr_vi)) {
>                 err = PTR_ERR(attr_vi);
>
> base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
> --
> 2.43.0
>


-- 
Thanks,
Hyunchul

[PATCH v2] ntfs: fail attrlist updates when the superblock is inactive

[Peiyang He]

generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes.
If eviction selects the fake inode for a base inode's unnamed
$ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's
reference on the base inode while the fake inode is still hashed and marked
I_FREEING.

That iput can synchronously write back the base inode. The writeback path
may update mapping pairs and call ntfs_attrlist_update(), which
unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake
inode. VFS then finds the I_FREEING inode and waits for eviction to finish,
but the current task is still inside that eviction path, causing a
self-deadlock in find_inode().

Fix this by mirroring the teardown guard used by __ntfs_write_inode():
once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode.
Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.

Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Closes: https://lore.kernel.org/all/AB8D5E603E6EA856+ae5f622a-dd3a-4e38-bdd2-42276ae0e1a8@smail.nju.edu.cn/
Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Assisted-by: Codex:gpt-5.5
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
Changes in v2:
  - add code comments
  - collect Reviewed-by

 fs/ntfs/attrlist.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index afb13038ba42..be3086d34338 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -57,6 +57,15 @@ int ntfs_attrlist_update(struct ntfs_inode *base_ni)
 	struct ntfs_inode *attr_ni;
 	int err;
 
+	/*
+	 * generic_shutdown_super() clears SB_ACTIVE before evicting cached
+	 * inodes. Do not look up the attribute-list inode after SB_ACTIVE has
+	 * been cleared; it may already be I_FREEING, and waiting on it can
+	 * self-deadlock.
+	 */
+	if (!(VFS_I(base_ni)->i_sb->s_flags & SB_ACTIVE))
+		return -EIO;
+
 	attr_vi = ntfs_attr_iget(VFS_I(base_ni), AT_ATTRIBUTE_LIST, AT_UNNAMED, 0);
 	if (IS_ERR(attr_vi)) {
 		err = PTR_ERR(attr_vi);

base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
-- 
2.43.0

Re: [PATCH v2] ntfs: fail attrlist updates when the superblock is inactive

[Namjae Jeon]

On Mon, Jul 6, 2026 at 1:01 PM Peiyang He <peiyang_he@smail.nju.edu.cn> wrote:
>
> generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes.
> If eviction selects the fake inode for a base inode's unnamed
> $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's
> reference on the base inode while the fake inode is still hashed and marked
> I_FREEING.
>
> That iput can synchronously write back the base inode. The writeback path
> may update mapping pairs and call ntfs_attrlist_update(), which
> unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake
> inode. VFS then finds the I_FREEING inode and waits for eviction to finish,
> but the current task is still inside that eviction path, causing a
> self-deadlock in find_inode().
>
> Fix this by mirroring the teardown guard used by __ntfs_write_inode():
> once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode.
> Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.
>
> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Closes: https://lore.kernel.org/all/AB8D5E603E6EA856+ae5f622a-dd3a-4e38-bdd2-42276ae0e1a8@smail.nju.edu.cn/
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> Assisted-by: Codex:gpt-5.5
> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Applied it to #ntfs-next.
Thanks!