[PATCH v1 0/4] ntfs: fix MFT bitmap extension allocation

[PATCH v1 0/4] ntfs: fix MFT bitmap extension allocation

[Xuewen Wang]

This series fixes four bugs in the MFT bitmap extension path:

  - The adjacent-cluster candidate can be outside the volume. Check it
    before accessing $Bitmap and fall back to the regular allocator.
  - The allocator can return an adjacent cluster that merges with the
    existing run. Preserve that run when rolling back a failed extension.
  - Rollback can wait for the initial $Bitmap scan while holding a folio
    the scanner needs. Wait for the scan before starting the allocation.
  - Direct allocation changes $Bitmap without updating the cached free
    counts. Update both counts and honor per-page accounting and space
    reserved for delayed allocation. 

Xuewen Wang (4):
  ntfs: bound the adjacent cluster in MFT bitmap extension
  ntfs: fix rollback after MFT bitmap run coalescing
  ntfs: wait for the bitmap scan before MFT bitmap extension
  ntfs: account for direct MFT bitmap cluster allocation

 fs/ntfs/mft.c | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

-- 
2.25.1

[PATCH v1 1/4] ntfs: bound the adjacent cluster in MFT bitmap extension

[Xuewen Wang]

When the last MFT bitmap run reaches the volume boundary, the direct
allocation path tests the bit for nr_clusters, an invalid LCN. A clear
bit allows an out-of-volume allocation; a bitmap read failure aborts
extension even if valid clusters remain available.

Check the candidate LCN before accessing $Bitmap and fall back to
ntfs_cluster_alloc() with no locality hint when it is outside the volume.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
---
 fs/ntfs/mft.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 8bb8b4085c8b..88bac85d22bc 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1377,6 +1377,11 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 	lcn = rl->lcn + rl->length;
 	ntfs_debug("Last lcn of mft bitmap attribute is 0x%llx.",
 			(long long)lcn);
+	/* There is no adjacent cluster if the last run ends at the volume end. */
+	if (lcn >= vol->nr_clusters) {
+		lcn = -1;
+		goto alloc_cluster;
+	}
 	/*
 	 * Attempt to get the cluster following the last allocated cluster by
 	 * hand as it may be in the MFT zone so the allocator would not give it
@@ -1413,6 +1418,7 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 		kunmap_local(b);
 		folio_put(folio);
 		up_write(&vol->lcnbmp_lock);
+alloc_cluster:
 		/* Allocate a cluster from the DATA_ZONE. */
 		rl2 = ntfs_cluster_alloc(vol, rl[1].vcn, 1, lcn, DATA_ZONE,
 				true, false, false);
-- 
2.25.1

[PATCH v1 2/4] ntfs: fix rollback after MFT bitmap run coalescing

[Xuewen Wang]

After the direct allocation attempt drops lcnbmp_lock, a concurrent free
can let ntfs_cluster_alloc() return the adjacent cluster. The merged
runlist then extends the existing last run, but rollback assumes a new
run was added. A later metadata failure removes the old mapping and
frees its first cluster.

Record whether the allocated cluster is adjacent before merging the
runlists. On rollback, shorten a coalesced run by one cluster and free
only that cluster; remove the new run for a non-adjacent allocation.

Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
---
 fs/ntfs/mft.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 88bac85d22bc..12666668a80e 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1428,6 +1428,8 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 					"Failed to allocate a cluster for the mft bitmap.");
 			return PTR_ERR(rl2);
 		}
+		/* The adjacent cluster may have become available while unlocked. */
+		status.added_cluster = rl2->lcn == lcn;
 		rl = ntfs_runlists_merge(&mftbmp_ni->runlist, rl2, 0, &new_rl_count);
 		if (IS_ERR(rl)) {
 			up_write(&mftbmp_ni->runlist.lock);
@@ -1442,8 +1444,8 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 		}
 		mftbmp_ni->runlist.rl = rl;
 		mftbmp_ni->runlist.count = new_rl_count;
-		status.added_run = 1;
-		ntfs_debug("Adding one run to mft bitmap.");
+		status.added_run = !status.added_cluster;
+		ntfs_debug("Allocated one cluster for mft bitmap.");
 		/* Find the last run in the new runlist. */
 		for (; rl[1].length; rl++)
 			;
-- 
2.25.1

[PATCH v1 3/4] ntfs: wait for the bitmap scan before MFT bitmap extension

[Xuewen Wang]

If MFT bitmap extension fails before the initial $Bitmap scan completes,
rollback calls ntfs_bitmap_clear_bit(), which holds a folio lock while
ntfs_set_lcn_empty_bits() waits for the scan. The scanner deadlocks if it
still needs that folio.

Wait for the initial scan before taking the runlist or bitmap folio locks
and attempting allocation.

Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
---
 fs/ntfs/mft.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 12666668a80e..489a5935202c 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1352,6 +1352,10 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 	size_t new_rl_count;
 
 	ntfs_debug("Extending mft bitmap allocation.");
+	/* The initial bitmap scan must finish before we lock or change a folio. */
+	if (!NVolFreeClusterKnown(vol))
+		wait_event(vol->free_waitq, NVolFreeClusterKnown(vol));
+
 	mft_ni = NTFS_I(vol->mft_ino);
 	mftbmp_ni = NTFS_I(vol->mftbmp_ino);
 	/*
-- 
2.25.1

[PATCH v1 4/4] ntfs: account for direct MFT bitmap cluster allocation

[Xuewen Wang]

The MFT bitmap extension fast path sets $Bitmap directly, bypassing
ntfs_cluster_alloc() and its free_clusters and lcn_empty_bits_per_page
updates. Successful extensions overreport free space, and rollback adds
back counts that were never deducted.

Update both counts under lcnbmp_lock and the bitmap folio lock. Require
a nonzero page count and space remaining after delayed-allocation
reservations; otherwise use the regular allocator. The page check also
prevents underflow when the initial scan recorded zero after a read error.

Fixes: 6251f0b0de7d ("ntfs: update super block operations")
Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
---
 fs/ntfs/mft.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 489a5935202c..e01e367a588d 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1404,10 +1404,18 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
 	folio_lock(folio);
 	b = (u8 *)kmap_local_folio(folio, 0) + (ll & ~PAGE_MASK);
 	tb = 1 << (lcn & 7ull);
-	if (*b != 0xff && !(*b & tb)) {
+	/*
+	 * A page skipped by the initial scan has no free bits recorded.
+	 * Honor that and the space reserved for delayed allocation.
+	 */
+	if (*b != 0xff && !(*b & tb) &&
+	    vol->lcn_empty_bits_per_page[ll >> PAGE_SHIFT] &&
+	    ntfs_available_clusters_count(vol, 1) > 0) {
 		/* Next cluster is free, allocate it. */
 		*b |= tb;
 		folio_mark_dirty(folio);
+		ntfs_dec_free_clusters(vol, 1);
+		ntfs_set_lcn_empty_bits(vol, ll >> PAGE_SHIFT, 1, 1);
 		folio_unlock(folio);
 		kunmap_local(b);
 		folio_put(folio);
-- 
2.25.1

Re: [PATCH v1 0/4] ntfs: fix MFT bitmap extension allocation

[liubaolin]

在 2026/9/24 09:45, Xuewen Wang 写道:
> This series fixes four bugs in the MFT bitmap extension path:
> 
>    - The adjacent-cluster candidate can be outside the volume. Check it
>      before accessing $Bitmap and fall back to the regular allocator.
>    - The allocator can return an adjacent cluster that merges with the
>      existing run. Preserve that run when rolling back a failed extension.
>    - Rollback can wait for the initial $Bitmap scan while holding a folio
>      the scanner needs. Wait for the scan before starting the allocation.
>    - Direct allocation changes $Bitmap without updating the cached free
>      counts. Update both counts and honor per-page accounting and space
>      reserved for delayed allocation.
> 
> Xuewen Wang (4):
>    ntfs: bound the adjacent cluster in MFT bitmap extension
>    ntfs: fix rollback after MFT bitmap run coalescing
>    ntfs: wait for the bitmap scan before MFT bitmap extension
>    ntfs: account for direct MFT bitmap cluster allocation
> 
>   fs/ntfs/mft.c | 26 +++++++++++++++++++++++---
>   1 file changed, 23 insertions(+), 3 deletions(-)
> 

The series looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>

Re: [PATCH v1 1/4] ntfs: bound the adjacent cluster in MFT bitmap extension

[liubaolin]

在 2026/9/24 09:45, Xuewen Wang 写道:
> When the last MFT bitmap run reaches the volume boundary, the direct
> allocation path tests the bit for nr_clusters, an invalid LCN. A clear
> bit allows an out-of-volume allocation; a bitmap read failure aborts
> extension even if valid clusters remain available.
> 
> Check the candidate LCN before accessing $Bitmap and fall back to
> ntfs_cluster_alloc() with no locality hint when it is outside the volume.
> 
> Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
> Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
> ---
>   fs/ntfs/mft.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
> index 8bb8b4085c8b..88bac85d22bc 100644
> --- a/fs/ntfs/mft.c
> +++ b/fs/ntfs/mft.c
> @@ -1377,6 +1377,11 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   	lcn = rl->lcn + rl->length;
>   	ntfs_debug("Last lcn of mft bitmap attribute is 0x%llx.",
>   			(long long)lcn);
> +	/* There is no adjacent cluster if the last run ends at the volume end. */
> +	if (lcn >= vol->nr_clusters) {
> +		lcn = -1;
> +		goto alloc_cluster;
> +	}
>   	/*
>   	 * Attempt to get the cluster following the last allocated cluster by
>   	 * hand as it may be in the MFT zone so the allocator would not give it
> @@ -1413,6 +1418,7 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   		kunmap_local(b);
>   		folio_put(folio);
>   		up_write(&vol->lcnbmp_lock);
> +alloc_cluster:
>   		/* Allocate a cluster from the DATA_ZONE. */
>   		rl2 = ntfs_cluster_alloc(vol, rl[1].vcn, 1, lcn, DATA_ZONE,
>   				true, false, false);

Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>

Re: [PATCH v1 2/4] ntfs: fix rollback after MFT bitmap run coalescing

[liubaolin]

在 2026/9/24 09:45, Xuewen Wang 写道:
> After the direct allocation attempt drops lcnbmp_lock, a concurrent free
> can let ntfs_cluster_alloc() return the adjacent cluster. The merged
> runlist then extends the existing last run, but rollback assumes a new
> run was added. A later metadata failure removes the old mapping and
> frees its first cluster.
> 
> Record whether the allocated cluster is adjacent before merging the
> runlists. On rollback, shorten a coalesced run by one cluster and free
> only that cluster; remove the new run for a non-adjacent allocation.
> 
> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
> Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
> Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
> ---
>   fs/ntfs/mft.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
> index 88bac85d22bc..12666668a80e 100644
> --- a/fs/ntfs/mft.c
> +++ b/fs/ntfs/mft.c
> @@ -1428,6 +1428,8 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   					"Failed to allocate a cluster for the mft bitmap.");
>   			return PTR_ERR(rl2);
>   		}
> +		/* The adjacent cluster may have become available while unlocked. */
> +		status.added_cluster = rl2->lcn == lcn;
>   		rl = ntfs_runlists_merge(&mftbmp_ni->runlist, rl2, 0, &new_rl_count);
>   		if (IS_ERR(rl)) {
>   			up_write(&mftbmp_ni->runlist.lock);
> @@ -1442,8 +1444,8 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   		}
>   		mftbmp_ni->runlist.rl = rl;
>   		mftbmp_ni->runlist.count = new_rl_count;
> -		status.added_run = 1;
> -		ntfs_debug("Adding one run to mft bitmap.");
> +		status.added_run = !status.added_cluster;
> +		ntfs_debug("Allocated one cluster for mft bitmap.");
>   		/* Find the last run in the new runlist. */
>   		for (; rl[1].length; rl++)
>   			;

Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>

Re: [PATCH v1 3/4] ntfs: wait for the bitmap scan before MFT bitmap extension

[liubaolin]

在 2026/9/24 09:45, Xuewen Wang 写道:
> If MFT bitmap extension fails before the initial $Bitmap scan completes,
> rollback calls ntfs_bitmap_clear_bit(), which holds a folio lock while
> ntfs_set_lcn_empty_bits() waits for the scan. The scanner deadlocks if it
> still needs that folio.
> 
> Wait for the initial scan before taking the runlist or bitmap folio locks
> and attempting allocation.
> 
> Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
> Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
> Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
> ---
>   fs/ntfs/mft.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
> index 12666668a80e..489a5935202c 100644
> --- a/fs/ntfs/mft.c
> +++ b/fs/ntfs/mft.c
> @@ -1352,6 +1352,10 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   	size_t new_rl_count;
>   
>   	ntfs_debug("Extending mft bitmap allocation.");
> +	/* The initial bitmap scan must finish before we lock or change a folio. */
> +	if (!NVolFreeClusterKnown(vol))
> +		wait_event(vol->free_waitq, NVolFreeClusterKnown(vol));
> +
>   	mft_ni = NTFS_I(vol->mft_ino);
>   	mftbmp_ni = NTFS_I(vol->mftbmp_ino);
>   	/*

Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>

Re: [PATCH v1 4/4] ntfs: account for direct MFT bitmap cluster allocation

[liubaolin]

在 2026/9/24 09:45, Xuewen Wang 写道:
> The MFT bitmap extension fast path sets $Bitmap directly, bypassing
> ntfs_cluster_alloc() and its free_clusters and lcn_empty_bits_per_page
> updates. Successful extensions overreport free space, and rollback adds
> back counts that were never deducted.
> 
> Update both counts under lcnbmp_lock and the bitmap folio lock. Require
> a nonzero page count and space remaining after delayed-allocation
> reservations; otherwise use the regular allocator. The page check also
> prevents underflow when the initial scan recorded zero after a read error.
> 
> Fixes: 6251f0b0de7d ("ntfs: update super block operations")
> Suggested-by: Baolin Liu <liubaolin@kylinos.cn>
> Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
> Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
> ---
>   fs/ntfs/mft.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
> index 489a5935202c..e01e367a588d 100644
> --- a/fs/ntfs/mft.c
> +++ b/fs/ntfs/mft.c
> @@ -1404,10 +1404,18 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(struct ntfs_volume *vol)
>   	folio_lock(folio);
>   	b = (u8 *)kmap_local_folio(folio, 0) + (ll & ~PAGE_MASK);
>   	tb = 1 << (lcn & 7ull);
> -	if (*b != 0xff && !(*b & tb)) {
> +	/*
> +	 * A page skipped by the initial scan has no free bits recorded.
> +	 * Honor that and the space reserved for delayed allocation.
> +	 */
> +	if (*b != 0xff && !(*b & tb) &&
> +	    vol->lcn_empty_bits_per_page[ll >> PAGE_SHIFT] &&
> +	    ntfs_available_clusters_count(vol, 1) > 0) {
>   		/* Next cluster is free, allocate it. */
>   		*b |= tb;
>   		folio_mark_dirty(folio);
> +		ntfs_dec_free_clusters(vol, 1);
> +		ntfs_set_lcn_empty_bits(vol, ll >> PAGE_SHIFT, 1, 1);
>   		folio_unlock(folio);
>   		kunmap_local(b);
>   		folio_put(folio);

Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>