Kernel RFC stops filesystems flipping SB_RDONLY after errors

A large class of Linux filesystems has long marked themselves read-only after I/O or metadata errors by setting SB_RDONLY from arbitrary contexts, without the s_umount lock that remount is supposed to hold. That shortcut races with every other writer of superblock flags and confuses the VFS freeze path.

freeze_super() and thaw_super() both consult sb_rdonly() to decide whether the s_writers locks must be taken or dropped. An error that flips the flag while the filesystem is frozen lets thaw take the read-only shortcut, leave the locks held, and mark the superblock unfrozen. Later writers hang in sb_start_write(); umount then warns when it frees the locked rwsems, and jfs can oops. Device-mapper suspend with lockfs is enough to trigger the race on filesystems that lack their own freeze_fs hook, because cached metadata can still raise errors.

Christian Brauner has posted an RFC series that finishes the conversion ext4 and f2fs already performed. Errors are recorded in filesystem-private state; the filesystem itself returns EROFS for modifications; the VFS superblock stays read-write and advertises an “emergency_ro” (or equivalent) mount option. Remount to read-write fails until umount; remount to read-only succeeds so sysrq-u emergency remount no longer warns and does not claim the volume is clean.

The series covers ext2, jfs, nilfs2, fat, exfat, hfs, affs, ufs, hpfs, ntfs, ocfs2, zonefs, btrfs, gfs2 (withdraw), efivarfs (ops notifier), and ubifs, plus follow-on remount fixes for ext4 and xfs so their emergency or shutdown states also accept a forced read-only remount without touching the disk. Jan Kara preferred fixing the filesystems over teaching thaw to remember lock state; Brauner agreed that changing SB_RDONLY behind the VFS’s back is the deeper bug.

Until the patches land, any of the listed filesystems can still leave writers permanently blocked after an error that coincides with a freeze.