[RFC PATCH 0/9] ext4: phase out inline data write paths for regular files

[Yun Zhou]

This series phases out the inline data write paths for regular files
while preserving directory inline data support.

Motivation
==========

The inline_data feature has been a persistent source of bugs in
ext4 over the past three years:

- 15 kernel bug fixes since mid-2023, including fixes for BUG_ON,
  use-after-free, out-of-bounds reads, race conditions, and data
  corruption
- 4 e2fsprogs bug fixes in the same period
- 6-8 syzbot reports currently open or continuously reproducing,
  including "kernel BUG in ext4_write_inline_data" reported 5 times
- 8+ CVEs: CVE-2023-52786, CVE-2024-42304, CVE-2025-38222,
  CVE-2025-38701, CVE-2025-40167, CVE-2025-68264, CVE-2026-31451,
  CVE-2026-31452

The root cause is architectural: inline data requires special handling
in write_begin/write_end, writepages, page_mkwrite, truncate, and
directory operations, with complex locking interactions between
xattr_sem, i_rwsem, i_data_sem, and page locks.

The benefit is minimal: inline data saves at most one 4K block per
small file.  In practice, very few regular files are small enough to
benefit from inline storage -- mostly only small directories gain from
it.  Major distributions do not enable inline_data by default in
mkfs.ext4.

Approach
========

Rather than removing inline data entirely (which would break existing
filesystems), this series takes a phased approach:

1. Emit a mount-time deprecation warning
2. Stop creating inline data for new regular files (directories retain
   inline capability as they benefit with minimal complexity)
3-5. Remove inline write paths and dead code for regular files
     (DA convert path addressed separately in patch 7)
6-7. Rework the conversion path to be atomic (no restore needed) and
   fix the syzbot-reported BUG_ON race
8. Update documentation
9. Close a pre-existing theoretical i_data_sem race window

After this series, existing inline data files are transparently
converted to block format on first write or mmap.  Reads continue to
work normally.  No data loss, no user-visible behavior change beyond
the conversion.

Testing
=======

- Full ext4 build passes with zero warnings
- xfstests smoketest (ext4/4k): 7 tests passed
- xfstests smoketest (ext4/inline, -O inline_data): 7 tests passed
  (fsstress + dm-error with inline_data enabled filesystem)

Future work (separate series, after community consensus):
- e2fsprogs: deprecate mkfs.ext4 -O inline_data (warn or refuse)
- e2fsprogs: add offline conversion in e2fsck/tune2fs to convert all
  inline data inodes to block format and clear the feature flag

Yun Zhou (9):
  ext4: add deprecation warning for inline_data feature
  ext4: stop creating inline data for new regular files
  ext4: use safe convert path for inline data write overflow
  ext4: remove inline data write paths for regular files
  ext4: remove dead inline data write code
  ext4: allocate block before destroying inline data in conversion
  ext4: remove DA convert path for regular file inline data
  ext4: document inline_data deprecation
  ext4: populate extent entry atomically during inline data destroy

 Documentation/filesystems/ext4/inlinedata.rst |   8 +
 fs/ext4/ext4.h                                |   7 -
 fs/ext4/ialloc.c                              |   4 +-
 fs/ext4/inline.c                              | 518 ++----------------
 fs/ext4/inode.c                               |  25 +-
 fs/ext4/super.c                               |   6 +
 6 files changed, 70 insertions(+), 498 deletions(-)

-- 
2.43.0