Kernel stops filesystems flipping read-only behind the VFS

A long-standing filesystem habit of marking a superblock read-only after I/O errors, without taking the VFS remount lock, is being ripped out of the Linux kernel. Christian Brauner is converting the remaining offenders to a dedicated emergency read-only state so that freeze, thaw, remount, and ordinary writers no longer fight over unlocked flag updates.

For years many filesystems, on error, simply set SB_RDONLY from whatever context noticed the failure. That flag is supposed to change only under s_umount during a proper remount. The unlocked write races every other path that touches superblock flags. Worse, freeze and thaw decide from the same bit whether writer locks must be taken or dropped. If an error flips the flag while the filesystem is frozen (for example under a device-mapper suspend), thaw leaves the writer semaphores held, marks the superblock unfrozen anyway, and every later writer stalls in sb_start_write. Unmount then warns about freeing locked state; JFS can oops.

Karl first spotted the freeze failure and proposed teaching thaw to remember whether it took the locks. Jan Kara argued for fixing the filesystems instead. ext4 and f2fs had already stopped touching SB_RDONLY on error. Brauner’s second version follows that direction with a VFS-wide answer: a sticky SB_STATE_EMERGENCY_RO bit that is only ever set, never cleared, while SB_RDONLY itself stays untouched so freeze and thaw keep a consistent view.

Filesystems call into the new helper where they used to force read-only. The VFS then rejects modifications with EROFS (including on files opened before the error), blocks a remount back to read-write, and still reports the mount as read-only in /proc/mounts, statmount, and statfs. A remount to read-only still succeeds so emergency remount (sysrq-u) does not warn and does not pretend the filesystem is clean. Writeback policy remains filesystem-specific.

The conversion covers the remaining holdouts and related remount bugs: exfat, HFS, NTFS, zonefs, GFS2 withdraw, efivarfs ops switches, plus ext4 and XFS paths that refused a forced read-only remount after shutdown or error and could panic under panic_on_warn. Mounts stay marked writable in userspace views until unmount, but writes fail with EROFS once the emergency state is set. Stable kernels are in the Cc list.