Linux stops marking filesystems read-only after errors

Christian Brauner has posted a VFS change that stops filesystems from marking themselves read-only after an error by writing the kernel's official read-only flag. That flag is only supposed to change during a proper remount, under the superblock lock. Many filesystems were setting it from whatever context found the error, racing with everyone else that updates mount flags and breaking freeze and thaw.

Freeze and thaw decide from that flag whether writer locks need to be taken or released. An error while a filesystem is frozen, including a device-mapper suspend, makes thaw leave those locks held. Every later writer then hangs, and unmount warns. JFS can crash. The same path has shown up in exfat, HFS, NTFS, zonefs, gfs2 withdraw, and efivarfs, which flips the flag when EFI variable operations switch between writable and read-only, including across suspend.

An earlier idea was to teach thaw to remember what the freeze had taken. Jan Kara preferred the approach ext4 and f2fs already use, and Brauner agreed. A first pass copied the same checks into every filesystem's open, attribute, and sync paths. Kara then suggested one superblock state instead.

The new emergency read-only bit is only ever set, never cleared, and leaves the official read-only flag alone so freezing still works. A filesystem calls a helper where it used to force read-only. The VFS then refuses modifications with EROFS, including through file descriptors opened before the error, refuses a remount back to read-write and a new freeze, and stops syncing the superblock: syncfs and quota sync fail with EROFS, while a global sync and unmount skip it. /proc/mounts, statmount, and statfs show the filesystem read-only, and a remount to read-only succeeds, so the emergency remount used by SysRq-u no longer warns. That remount does not mark the filesystem clean.

Writeback is not stopped. The flusher and the block-device flushes in sync and unmount keep writing, so what lands on disk is what mainline already writes, and each filesystem still decides what its own writeback does. Paths that never go through the VFS, including allocators, journals, deletion of unlinked inodes, and some ecryptfs xattr and ACL setters, are unchanged.

Stable fixes stay self-contained. Follow-ups move exfat, HFS, NTFS, zonefs, and ext4 onto the generic state. Fat, exfat, HPFS, and NTFS still set the official flag in some cases. Separate fixes in the same work stop ext4 and XFS from failing an emergency remount after a shutdown or error: both returned an error that reconfigure_super warns on, which panics if panic-on-warn is set. Going read-only is allowed without writing anything; going back to read-write is still refused. On gfs2, a withdraw that had not finished could also trip a bug during a read-only remount, so remount now waits for the journal to go dead first.