Re: [PATCH v3 0/5] ntfs: support O_TMPFILE

[Namjae Jeon]

On Fri, Nov 6, 2026 at 3:31 PM Baolin Liu <liubaolin12138@xxxxxxx> wrote:
>
> From: Baolin Liu <liubaolin@xxxxxxxxxx>
Hi Baolin,
>
> This series adds O_TMPFILE support to fs/ntfs. Applications can prepare a
> regular file's contents and metadata before publishing it with linkat().
> Unpublished files are reclaimed when their last reference is released.
> O_EXCL prevents publication.
>
> The series keeps the same five changes and ordering as v1 and v2:
>
>   1. Initialize inherited ACLs after allocating the new MFT record.
>      Anonymous creation needs its inherited ACL stored before returning.
>   2. Preserve prepared atime and mtime when publishing the inode through
>      the hard-link path.
>   3. Initialize the new FILE_NAME's packed EA size, since a temporary
>      file may already have EAs when it is published.
>   4. Complete unlinked-file attribute writes before dropping the cache,
>      including EAs and data copied during resident-to-nonresident
>      conversion before publication.
>   5. Add O_TMPFILE creation and publication support.
>
> As requested in review, patch 2 gives the new FILE_NAME and directory
> index entry the same ctime as the inode. The inode ctime is updated only
> after the link succeeds. Patch 1 also initializes a newly created
> FILE_NAME's ctime after inherited ACL setup, fixing a timestamp mismatch
> caused by moving ACL initialization later in v1.
>
> In v3, patch 4 also preserves data copied by
> ntfs_attr_make_non_resident(). As reported in review, growing DATA in a
> nearly full MFT record can convert SECURITY_DESCRIPTOR and leave its
> contents only in a dirty folio. Evicting the zero-link attribute inode
> then discards those contents.
>
> Write the resident value to the newly allocated clusters before
> committing the conversion. If that write fails, release the new clusters
> and retain the original resident value. Propagate the error to the caller
> instead of continuing with another attribute. Patches 1-3 and 5 are
> unchanged in code from v2.
>
> While implementing and testing O_TMPFILE, we also found pre-existing
> NTFS bugs in attribute rollback and ACL lookup. These include stale
> attribute inodes left cached after failed creation, which can cause
> subsequent creation to return EIO even after space is freed, incorrect
> ACL inheritance when the default ACL is not cached, and a fixed-size
> read buffer that cannot handle larger ACL values. The underlying bugs
> predate this series.
>
> To keep this series focused on O_TMPFILE support and review
> feedback, we are leaving these existing bugs to a separate bug-fix
> series. We plan to submit those fixes after this series is accepted and
> merged. These issues remain present with this series applied.
>
> Tested this five-patch series in QEMU with four CPUs, NTFS debug and
> lockdep enabled. The requested unchanged xfstests generic/004 and
> generic/389 passed. Tests covered creation, publication, last-reference
> cleanup, O_EXCL, normal idmapped ownership, named streams, nonresident
> EAs, direct I/O, mmap, allocation and concurrent publication. Published
> data and metadata were checked after cache eviction, remount and reboot.
> Offline inspection compared hard-link ctime in STANDARD_INFORMATION,
> the new FILE_NAME and the directory index.
>
> The conversion regression uses 1 KiB MFT records and varies EA sizes
> before writing 4 KiB to anonymous and ordinary files. Offline inspection
> compares SECURITY_DESCRIPTOR contents with the original resident value.
> The v2 kernel loses converted security descriptors and some EAs; v3
> preserves them with 512-byte, 4 KiB and 8 KiB clusters, including after a
> fresh boot. An injected block write error returns EIO and leaves the
> resident security descriptor and EA intact. Free space is unchanged after
> that failure, and retrying the write succeeds.
>
> Changes in v3:
> - Extend patch 4 to write converted attribute data before switching the
>   record to nonresident form, addressing the v2 review.
> - Preserve the resident value on conversion write failure and propagate
>   conversion errors.
> - Add conversion and I/O-error regression tests and rerun generic/004
>   and generic/389.
> - No code changes to patches 1-3 and 5; add Hyunchul Lee's Reviewed-by.
>
> Changes in v2:
> - Update FILE_NAME and index ctime as requested in review.
> - Set the source inode ctime only after successful hard-link creation.
> - Initialize creation FILE_NAME ctime after inherited ACL setup.
> - Run generic/004 and generic/389 on the standalone five-patch series.
> - Rebase onto ntfs-next commit
>   564c7753647731d19170914c1c637d3b33d88d3b, including the const mnt_idmap
>   tmpfile callback signature and documentation context.
> - Resolve patch 1 against the updated early ACL error handling in
>   __ntfs_create(); the relocated ACL failure still uses MFT/EA rollback.
> - Keep the original five-patch scope; submit fixes for the pre-existing
>   attribute rollback and ACL lookup bugs separately after this series
>   is merged.
> - No functional changes to patches 3 and 4.
>
> Baolin Liu (2):
>   ntfs: initialize inherited ACLs after allocating the MFT record
>   ntfs: support O_TMPFILE
>
> Xuewen Wang (3):
>   ntfs: preserve timestamps when creating hard links
>   ntfs: initialize packed EA size when creating hard links
>   ntfs: write unlinked file attributes before dropping their cache

Can you check Sashiko's review comments? I think some of the points
raised in Sashiko’s review are worth looking into.

https://sashiko.dev/#/patchset/20261106063059.2904988-1-liubaolin12138%40163.com

Thanks.