* [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
@ 2026-09-20 2:59 Hongling Zeng
2026-09-20 11:25 ` liubaolin
0 siblings, 1 reply; 6+ messages in thread
From: Hongling Zeng @ 2026-09-20 2:59 UTC (permalink / raw)
To: linkinjeon, hyc.lee
Cc: ntfs, linux-kernel, zhongling0719, Hongling Zeng, stable
The hibernation check in load_system_files() only converts the
superblock to read-only under errors=remount-ro. With the default
errors=continue (and with errors=panic), a hibernated volume is
mounted read-write and the mount-time $LogFile emptying writes to it,
although a hibernated volume must not be written to at all.
Drop the on_errors term so that a hibernated volume, or a volume whose
hibernation state cannot be determined, always mounts read-only.
NVolErrors() is still recorded, so ntfs_reconfigure() keeps refusing
remounts to read-write, and the $LogFile emptying is skipped by its
!sb_rdonly() check.
The check itself must not apply the errors= policy either: it runs
before SB_RDONLY is set, and ntfs_lookup_inode_by_name() and
ntfs_iget() call ntfs_error() internally on corruption or I/O errors,
which under errors=panic would panic the machine before the read-only
fallback has made its decision. Run the check with the super block
temporarily marked read-only, which makes ntfs_handle_error() ignore
any ntfs_error() issued on this path; the super block is not
published yet at this point, so the temporary flag is not visible
elsewhere.
Restore read-write access only if the check succeeded and no errors
were recorded earlier during the mount, e.g. when loading the LogFile,
so that a volume with recorded errors stays read-only, matching what
ntfs_reconfigure() enforces for remounts, and a message is logged for
that case.
Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
Change in v5:
-Rework the errors=panic handling per review feedback.
---
fs/ntfs/super.c | 36 +++++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index f4a73e45773d..ab91cd1a8515 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1398,6 +1398,7 @@ static bool load_system_files(struct ntfs_volume *vol)
struct ntfs_attr_search_ctx *ctx;
struct restart_page_header *rp;
int err;
+ bool temporary_ro = false;
ntfs_debug("Entering.");
/* Get mft mirror inode compare the contents of $MFT and $MFTMirr. */
@@ -1572,8 +1573,20 @@ static bool load_system_files(struct ntfs_volume *vol)
* NVolErrors() without setting the dirty volume flag and mount
* read-only. This will prevent read-write remounting and it will also
* prevent all writes.
+ *
+ * The check runs with the super block temporarily marked read-only, so
+ * that ntfs_error() calls issued internally by ntfs_lookup_inode_by_name()
+ * and ntfs_iget() cannot trigger errors=panic before the read-only
+ * fallback has run. The super block is not published yet, so the flag
+ * is not visible elsewhere.
*/
+ if (!sb_rdonly(sb)) {
+ sb->s_flags |= SB_RDONLY;
+ temporary_ro = true;
+ }
err = check_windows_hibernation_status(vol);
+ if (temporary_ro && !err && !NVolErrors(vol))
+ sb->s_flags &= ~SB_RDONLY;
if (unlikely(err)) {
static const char *es1a = "Failed to determine if Windows is hibernated";
static const char *es1b = "Windows is hibernated";
@@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
const char *es1;
es1 = err < 0 ? es1a : es1b;
- /* If a read-write mount, convert it to a read-only mount. */
- if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
- sb->s_flags |= SB_RDONLY;
- ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
- }
+ /*
+ * A Windows hibernation image is not a filesystem error, so
+ * this is a safety interlock rather than something the
+ * errors= policy may downgrade. The super block is already
+ * read-only here: the temporary flag taken for the check
+ * above is not restored when the check failed.
+ */
+ ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
NVolSetErrors(vol);
+ } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
+ static const char *es1 = "Errors were recorded during mount";
+ static const char *es2 = ". Run chkdsk.";
+
+ /*
+ * Errors were recorded during the check or earlier, e.g. when
+ * loading the LogFile. Stay read-only, like ntfs_reconfigure()
+ * does for volumes with recorded errors.
+ */
+ ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
}
/* If (still) a read-write mount, empty the logfile. */
--
2.25.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
2026-09-20 2:59 [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors= Hongling Zeng
@ 2026-09-20 11:25 ` liubaolin
2026-09-21 7:57 ` Hyunchul Lee
0 siblings, 1 reply; 6+ messages in thread
From: liubaolin @ 2026-09-20 11:25 UTC (permalink / raw)
To: Hongling Zeng, linkinjeon, hyc.lee
Cc: ntfs, linux-kernel, zhongling0719, stable
在 2026/9/20 10:59, Hongling Zeng 写道:
> The hibernation check in load_system_files() only converts the
> superblock to read-only under errors=remount-ro. With the default
> errors=continue (and with errors=panic), a hibernated volume is
> mounted read-write and the mount-time $LogFile emptying writes to it,
> although a hibernated volume must not be written to at all.
>
> Drop the on_errors term so that a hibernated volume, or a volume whose
> hibernation state cannot be determined, always mounts read-only.
> NVolErrors() is still recorded, so ntfs_reconfigure() keeps refusing
> remounts to read-write, and the $LogFile emptying is skipped by its
> !sb_rdonly() check.
>
> The check itself must not apply the errors= policy either: it runs
> before SB_RDONLY is set, and ntfs_lookup_inode_by_name() and
> ntfs_iget() call ntfs_error() internally on corruption or I/O errors,
> which under errors=panic would panic the machine before the read-only
> fallback has made its decision. Run the check with the super block
> temporarily marked read-only, which makes ntfs_handle_error() ignore
> any ntfs_error() issued on this path; the super block is not
> published yet at this point, so the temporary flag is not visible
> elsewhere.
>
> Restore read-write access only if the check succeeded and no errors
> were recorded earlier during the mount, e.g. when loading the LogFile,
> so that a volume with recorded errors stays read-only, matching what
> ntfs_reconfigure() enforces for remounts, and a message is logged for
> that case.
>
> Fixes: 6251f0b0de7d ("ntfs: update super block operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
> Change in v5:
> -Rework the errors=panic handling per review feedback.
> ---
> fs/ntfs/super.c | 36 +++++++++++++++++++++++++++++++-----
> 1 file changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
> index f4a73e45773d..ab91cd1a8515 100644
> --- a/fs/ntfs/super.c
> +++ b/fs/ntfs/super.c
> @@ -1398,6 +1398,7 @@ static bool load_system_files(struct ntfs_volume *vol)
> struct ntfs_attr_search_ctx *ctx;
> struct restart_page_header *rp;
> int err;
> + bool temporary_ro = false;
>
> ntfs_debug("Entering.");
> /* Get mft mirror inode compare the contents of $MFT and $MFTMirr. */
> @@ -1572,8 +1573,20 @@ static bool load_system_files(struct ntfs_volume *vol)
> * NVolErrors() without setting the dirty volume flag and mount
> * read-only. This will prevent read-write remounting and it will also
> * prevent all writes.
> + *
> + * The check runs with the super block temporarily marked read-only, so
> + * that ntfs_error() calls issued internally by ntfs_lookup_inode_by_name()
> + * and ntfs_iget() cannot trigger errors=panic before the read-only
> + * fallback has run. The super block is not published yet, so the flag
> + * is not visible elsewhere.
> */
> + if (!sb_rdonly(sb)) {
> + sb->s_flags |= SB_RDONLY;
> + temporary_ro = true;
> + }
> err = check_windows_hibernation_status(vol);
> + if (temporary_ro && !err && !NVolErrors(vol))
> + sb->s_flags &= ~SB_RDONLY;
Hi Hongling,
Thanks for sending the updated patch. I'm sorry, but while reviewing
this version more closely, I found a problem with the temporary
read-only approach I suggested during the v3 discussion.
The condition above does not reliably establish whether read-write
access can be restored. An ntfs_error() call does not necessarily set
NVolErrors(), and some errors reported by nested helpers are not
propagated back to the hibernation check.
For example, ntfs_attr_readall() can report "Invalid attribute data
size" and return -EIO without setting NVolErrors(). If this happens
while reading the optional WSL extended attributes through
ntfs_ea_get_wsl_inode(), the error can be ignored and inode loading can
still succeed. If the hibernation header is otherwise valid and
zero-filled, the check can then return zero.
With errors=remount-ro, the original code would retain the read-only
state set by that ntfs_error() call. With v5, ntfs_handle_error()
returns immediately because SB_RDONLY is already set, and the condition
above can subsequently restore read-write access because neither err nor
NVolErrors() reflects that error.
This makes it difficult to define a reliable restoration condition
using only the check's return value and NVolErrors().
I now think a better approach is to temporarily replace
ON_ERRORS_PANIC with ON_ERRORS_REMOUNT_RO around
check_windows_hibernation_status(), then restore the original policy
immediately afterwards. This covers both direct and nested
ntfs_error() calls while preserving any read-only transition they
trigger. The temporary substitution leaves the existing errors=continue
and errors=remount-ro policies unchanged.
This deliberately falls back to read-only for any ntfs_error() that
would otherwise trigger panic during the check, including recoverable
errors. I think that is a reasonable conservative fallback: it avoids
panic without treating every such error as a persistent volume error by
automatically setting NVolErrors().
If the check reports hibernation or fails, we would still
unconditionally set SB_RDONLY and NVolErrors(). We would also retain
your protection for volumes with errors recorded during the check or
earlier in the mount.
The following is a replacement patch against the same base as your v5:
@@ -1398,6 +1398,7 @@ static bool load_system_files(struct
ntfs_volume *vol)
struct ntfs_attr_search_ctx *ctx;
struct restart_page_header *rp;
int err;
+ u8 saved_on_errors;
ntfs_debug("Entering.");
/* Get mft mirror inode compare the contents of $MFT and $MFTMirr. */
@@ -1572,8 +1573,18 @@ static bool load_system_files(struct
ntfs_volume *vol)
* NVolErrors() without setting the dirty volume flag and mount
* read-only. This will prevent read-write remounting and it will also
* prevent all writes.
+ *
+ * Nested lookup and inode-loading errors must not panic before the
+ * read-only fallback. Temporarily use errors=remount-ro instead of
+ * errors=panic, preserving any read-only transition even if an error
+ * is not propagated or recorded in NVolErrors(). This is safe during
+ * initial mount, before the super block is published.
*/
+ saved_on_errors = vol->on_errors;
+ if (saved_on_errors == ON_ERRORS_PANIC)
+ vol->on_errors = ON_ERRORS_REMOUNT_RO;
err = check_windows_hibernation_status(vol);
+ vol->on_errors = saved_on_errors;
if (unlikely(err)) {
static const char *es1a = "Failed to determine if Windows is
hibernated";
static const char *es1b = "Windows is hibernated";
@@ -1581,12 +1592,15 @@ static bool load_system_files(struct
ntfs_volume *vol)
const char *es1;
es1 = err < 0 ? es1a : es1b;
- /* If a read-write mount, convert it to a read-only mount. */
- if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
- sb->s_flags |= SB_RDONLY;
- ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
- }
+ /* Hibernation safety takes precedence over the errors= policy. */
+ sb->s_flags |= SB_RDONLY;
NVolSetErrors(vol);
+ ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
+ } else if (!sb_rdonly(sb) && NVolErrors(vol)) {
+ /* Match the read-write remount restriction for recorded errors. */
+ sb->s_flags |= SB_RDONLY;
+ ntfs_error(sb,
+ "Errors were recorded during mount. Mounting read-only. Run
chkdsk.");
}
/* If (still) a read-write mount, empty the logfile. */
Sorry again for overlooking this issue in my earlier suggestion. I
believe this approach is more robust because it never clears SB_RDONLY,
so it does not need to reconstruct whether a nested error should have
made the volume read-only. The policy change is limited to the
hibernation check during initial mount, before the superblock is published.
If you agree with this approach, could you please incorporate it and
send another revision? I'd appreciate feedback from you, Namjae, and
Hyunchul.
feel free to add:
Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
Thanks,
Baolin.
> if (unlikely(err)) {
> static const char *es1a = "Failed to determine if Windows is hibernated";
> static const char *es1b = "Windows is hibernated";
> @@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
> const char *es1;
>
> es1 = err < 0 ? es1a : es1b;
> - /* If a read-write mount, convert it to a read-only mount. */
> - if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
> - sb->s_flags |= SB_RDONLY;
> - ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> - }
> + /*
> + * A Windows hibernation image is not a filesystem error, so
> + * this is a safety interlock rather than something the
> + * errors= policy may downgrade. The super block is already
> + * read-only here: the temporary flag taken for the check
> + * above is not restored when the check failed.
> + */
> + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> NVolSetErrors(vol);
> + } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
> + static const char *es1 = "Errors were recorded during mount";
> + static const char *es2 = ". Run chkdsk.";
> +
> + /*
> + * Errors were recorded during the check or earlier, e.g. when
> + * loading the LogFile. Stay read-only, like ntfs_reconfigure()
> + * does for volumes with recorded errors.
> + */
> + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> }
>
> /* If (still) a read-write mount, empty the logfile. */
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
2026-09-20 11:25 ` liubaolin
@ 2026-09-21 7:57 ` Hyunchul Lee
2026-09-21 9:30 ` dd
0 siblings, 1 reply; 6+ messages in thread
From: Hyunchul Lee @ 2026-09-21 7:57 UTC (permalink / raw)
To: liubaolin, Hongling Zeng
Cc: linkinjeon, ntfs, linux-kernel, zhongling0719, stable
Hi Baolin, Hongling
> If you agree with this approach, could you please incorporate it and
> send another revision? I'd appreciate feedback from you, Namjae, and
> Hyunchul.
I agree with this approach. It looks sound to me.
>
> feel free to add:
> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
>
> Thanks,
> Baolin.
>
>
>
>
>
>
>
> > if (unlikely(err)) {
> > static const char *es1a = "Failed to determine if Windows is hibernated";
> > static const char *es1b = "Windows is hibernated";
> > @@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
> > const char *es1;
> >
> > es1 = err < 0 ? es1a : es1b;
> > - /* If a read-write mount, convert it to a read-only mount. */
> > - if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
> > - sb->s_flags |= SB_RDONLY;
> > - ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> > - }
> > + /*
> > + * A Windows hibernation image is not a filesystem error, so
> > + * this is a safety interlock rather than something the
> > + * errors= policy may downgrade. The super block is already
> > + * read-only here: the temporary flag taken for the check
> > + * above is not restored when the check failed.
> > + */
> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> > NVolSetErrors(vol);
> > + } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
> > + static const char *es1 = "Errors were recorded during mount";
> > + static const char *es2 = ". Run chkdsk.";
> > +
> > + /*
> > + * Errors were recorded during the check or earlier, e.g. when
> > + * loading the LogFile. Stay read-only, like ntfs_reconfigure()
> > + * does for volumes with recorded errors.
> > + */
> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> > }
> >
> > /* If (still) a read-write mount, empty the logfile. */
>
--
Thanks,
Hyunchul
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re:Re: [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
2026-09-21 7:57 ` Hyunchul Lee
@ 2026-09-21 9:30 ` dd
2026-09-22 0:16 ` liubaolin
2026-09-22 1:26 ` Hyunchul Lee
0 siblings, 2 replies; 6+ messages in thread
From: dd @ 2026-09-21 9:30 UTC (permalink / raw)
To: Hyunchul Lee
Cc: liubaolin, Hongling Zeng, linkinjeon, ntfs, linux-kernel, stable
Hi baolin,
Thanks for catching this. I agree that temporarily setting
SB_RDONLY
makes it impossible to distinguish an error suppressed by
ntfs_handle_error()
from a successful check. In particular, errors from optional WSL EA loading may neither propagate through the hibernation check nor set
NVolErrors()
, allowing the flag to be cleared incorrectly.
Hi all:
One question: with errors=panic, a corrupt $LogFile can still panic
during load_system_files(), before the hibernation fallback is reached.
For example, ntfs_check_logfile() panics on "LogFile is too small".
Should mount-time metadata errors generally avoid errors=panic before
the superblock is published? If so, that seems like a separate follow-up
to extend the temporary policy substitution over load_system_files().
Thanks!
At 2026-09-21 15:57:29, "Hyunchul Lee" <hyc.lee@gmail.com> wrote:
>Hi Baolin, Hongling
>
>> If you agree with this approach, could you please incorporate it and
>> send another revision? I'd appreciate feedback from you, Namjae, and
>> Hyunchul.
>
>I agree with this approach. It looks sound to me.
>
>>
>> feel free to add:
>> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
>>
>> Thanks,
>> Baolin.
>>
>>
>>
>>
>>
>>
>>
>> > if (unlikely(err)) {
>> > static const char *es1a = "Failed to determine if Windows is hibernated";
>> > static const char *es1b = "Windows is hibernated";
>> > @@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
>> > const char *es1;
>> >
>> > es1 = err < 0 ? es1a : es1b;
>> > - /* If a read-write mount, convert it to a read-only mount. */
>> > - if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
>> > - sb->s_flags |= SB_RDONLY;
>> > - ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>> > - }
>> > + /*
>> > + * A Windows hibernation image is not a filesystem error, so
>> > + * this is a safety interlock rather than something the
>> > + * errors= policy may downgrade. The super block is already
>> > + * read-only here: the temporary flag taken for the check
>> > + * above is not restored when the check failed.
>> > + */
>> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>> > NVolSetErrors(vol);
>> > + } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
>> > + static const char *es1 = "Errors were recorded during mount";
>> > + static const char *es2 = ". Run chkdsk.";
>> > +
>> > + /*
>> > + * Errors were recorded during the check or earlier, e.g. when
>> > + * loading the LogFile. Stay read-only, like ntfs_reconfigure()
>> > + * does for volumes with recorded errors.
>> > + */
>> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>> > }
>> >
>> > /* If (still) a read-write mount, empty the logfile. */
>>
>
>
>--
>Thanks,
>Hyunchul
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
2026-09-21 9:30 ` dd
@ 2026-09-22 0:16 ` liubaolin
2026-09-22 1:26 ` Hyunchul Lee
1 sibling, 0 replies; 6+ messages in thread
From: liubaolin @ 2026-09-22 0:16 UTC (permalink / raw)
To: dd, Hyunchul Lee; +Cc: Hongling Zeng, linkinjeon, ntfs, linux-kernel, stable
在 2026/9/21 17:30, dd 写道:
> Hi baolin,
> Thanks for catching this. I agree that temporarily setting
> SB_RDONLY
> makes it impossible to distinguish an error suppressed by
> ntfs_handle_error()
> from a successful check. In particular, errors from optional WSL EA loading may neither propagate through the hibernation check nor set
> NVolErrors()
> , allowing the flag to be cleared incorrectly.
>
> Hi all:
> One question: with errors=panic, a corrupt $LogFile can still panic
> during load_system_files(), before the hibernation fallback is reached.
> For example, ntfs_check_logfile() panics on "LogFile is too small".
>
> Should mount-time metadata errors generally avoid errors=panic before
> the superblock is published? If so, that seems like a separate follow-up
> to extend the temporary policy substitution over load_system_files().
>
> Thanks!
Hi Hongling,
Yes, the earlier $LogFile check can still panic. I would keep that
behavior and limit the temporary substitution to the hibernation check.
The intention of this exception is to preserve read-only access where
possible when we cannot establish whether Windows is hibernated.Refusing
write access provides a conservative outcome in that case, without
bringing down the whole system. Temporarily substituting remount-ro lets
us reach that outcome even when nested lookup or inode-loading helpers
call ntfs_error().
This deliberately also covers genuine metadata errors encountered
during the probe. It is a limited policy exception for the hibernation
check,rather than a requirement to suppress panic throughout mount.
A corrupt $LogFile detected earlier is an independent filesystem
error.Honoring the user's explicit errors=panic choice there is
reasonable,and that path will not proceed to the subsequent $LogFile
emptying.I do not think the hibernation exception requires changing that
behavior.
Also, extending the substitution over load_system_files() would not
cover the whole mount process: boot-sector processing and the initial
$MFT loading happen before it. Extending it further to cover all mount
stages would effectively make errors=panic apply only after a successful
mount, while using remount-ro during mount. I think that would override
the user's selected policy too broadly.
So my preference is to keep the temporary substitution around
check_windows_hibernation_status() and preserve the existing policy
elsewhere.
Thanks,
Baolin.
>
> At 2026-09-21 15:57:29, "Hyunchul Lee" <hyc.lee@gmail.com> wrote:
>> Hi Baolin, Hongling
>>
>>> If you agree with this approach, could you please incorporate it and
>>> send another revision? I'd appreciate feedback from you, Namjae, and
>>> Hyunchul.
>>
>> I agree with this approach. It looks sound to me.
>>
>>>
>>> feel free to add:
>>> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
>>>
>>> Thanks,
>>> Baolin.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>> if (unlikely(err)) {
>>>> static const char *es1a = "Failed to determine if Windows is hibernated";
>>>> static const char *es1b = "Windows is hibernated";
>>>> @@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
>>>> const char *es1;
>>>>
>>>> es1 = err < 0 ? es1a : es1b;
>>>> - /* If a read-write mount, convert it to a read-only mount. */
>>>> - if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
>>>> - sb->s_flags |= SB_RDONLY;
>>>> - ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>>>> - }
>>>> + /*
>>>> + * A Windows hibernation image is not a filesystem error, so
>>>> + * this is a safety interlock rather than something the
>>>> + * errors= policy may downgrade. The super block is already
>>>> + * read-only here: the temporary flag taken for the check
>>>> + * above is not restored when the check failed.
>>>> + */
>>>> + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>>>> NVolSetErrors(vol);
>>>> + } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
>>>> + static const char *es1 = "Errors were recorded during mount";
>>>> + static const char *es2 = ". Run chkdsk.";
>>>> +
>>>> + /*
>>>> + * Errors were recorded during the check or earlier, e.g. when
>>>> + * loading the LogFile. Stay read-only, like ntfs_reconfigure()
>>>> + * does for volumes with recorded errors.
>>>> + */
>>>> + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
>>>> }
>>>>
>>>> /* If (still) a read-write mount, empty the logfile. */
>>>
>>
>>
>> --
>> Thanks,
>> Hyunchul
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Re: [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors=
2026-09-21 9:30 ` dd
2026-09-22 0:16 ` liubaolin
@ 2026-09-22 1:26 ` Hyunchul Lee
1 sibling, 0 replies; 6+ messages in thread
From: Hyunchul Lee @ 2026-09-22 1:26 UTC (permalink / raw)
To: dd; +Cc: liubaolin, Hongling Zeng, linkinjeon, ntfs, linux-kernel, stable
Hi Hongling,
2026년 9월 21일 (월) 오후 6:30, dd <zhongling0719@126.com>님이 작성:
>
> Hi baolin,
> Thanks for catching this. I agree that temporarily setting
> SB_RDONLY
> makes it impossible to distinguish an error suppressed by
> ntfs_handle_error()
> from a successful check. In particular, errors from optional WSL EA loading may neither propagate through the hibernation check nor set
> NVolErrors()
> , allowing the flag to be cleared incorrectly.
>
> Hi all:
> One question: with errors=panic, a corrupt $LogFile can still panic
> during load_system_files(), before the hibernation fallback is reached.
> For example, ntfs_check_logfile() panics on "LogFile is too small".
>
> Should mount-time metadata errors generally avoid errors=panic before
> the superblock is published? If so, that seems like a separate follow-up
> to extend the temporary policy substitution over load_system_files().
As Baolin mentioned, I don't think that mount-time metadata should
generally bypass error=panic.
>
> Thanks!
>
> At 2026-09-21 15:57:29, "Hyunchul Lee" <hyc.lee@gmail.com> wrote:
> >Hi Baolin, Hongling
> >
> >> If you agree with this approach, could you please incorporate it and
> >> send another revision? I'd appreciate feedback from you, Namjae, and
> >> Hyunchul.
> >
> >I agree with this approach. It looks sound to me.
> >
> >>
> >> feel free to add:
> >> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
> >>
> >> Thanks,
> >> Baolin.
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> > if (unlikely(err)) {
> >> > static const char *es1a = "Failed to determine if Windows is hibernated";
> >> > static const char *es1b = "Windows is hibernated";
> >> > @@ -1581,12 +1594,25 @@ static bool load_system_files(struct ntfs_volume *vol)
> >> > const char *es1;
> >> >
> >> > es1 = err < 0 ? es1a : es1b;
> >> > - /* If a read-write mount, convert it to a read-only mount. */
> >> > - if (!sb_rdonly(sb) && vol->on_errors == ON_ERRORS_REMOUNT_RO) {
> >> > - sb->s_flags |= SB_RDONLY;
> >> > - ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> >> > - }
> >> > + /*
> >> > + * A Windows hibernation image is not a filesystem error, so
> >> > + * this is a safety interlock rather than something the
> >> > + * errors= policy may downgrade. The super block is already
> >> > + * read-only here: the temporary flag taken for the check
> >> > + * above is not restored when the check failed.
> >> > + */
> >> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> >> > NVolSetErrors(vol);
> >> > + } else if (unlikely(temporary_ro && sb_rdonly(sb))) {
> >> > + static const char *es1 = "Errors were recorded during mount";
> >> > + static const char *es2 = ". Run chkdsk.";
> >> > +
> >> > + /*
> >> > + * Errors were recorded during the check or earlier, e.g. when
> >> > + * loading the LogFile. Stay read-only, like ntfs_reconfigure()
> >> > + * does for volumes with recorded errors.
> >> > + */
> >> > + ntfs_error(sb, "%s. Mounting read-only%s", es1, es2);
> >> > }
> >> >
> >> > /* If (still) a read-write mount, empty the logfile. */
> >>
> >
> >
> >--
> >Thanks,
> >Hyunchul
--
Thanks,
Hyunchul
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-22 1:27 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-20 2:59 [PATCH v5] ntfs: mount hibernated volumes read-only regardless of errors= Hongling Zeng
2026-09-20 11:25 ` liubaolin
2026-09-21 7:57 ` Hyunchul Lee
2026-09-21 9:30 ` dd
2026-09-22 0:16 ` liubaolin
2026-09-22 1:26 ` Hyunchul Lee
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®