Merge tag 'ntfs-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

Pull ntfs updates from Namjae Jeon:
 "New features:

   - Implement ioctls to list, read, write, and remove named streams on
     files and directories. Provide optional file:stream pathname access
     through streams_interface=windows, exposing streams as regular file
     descriptors with support for mmap, locking, truncation, and
     allocation.

   - Support file attribute queries and updates through FS_IOC_GETFLAGS
     and FS_IOC_SETFLAGS. Store immutable, append-only, nodump, and
     noatime settings in the private $LINUXFLAGS extended attribute and
     restore them when loading inodes. Also report compression,
     encryption, and the mount-wide case-folding policy as read-only
     attributes.

  Other changes:

   - Expose the existing NTFS volume serial number through FS_IOC_GETFSUUID
     by registering it as an eight-byte filesystem identifier.

   - Validate MFT I/O geometry and write MFT records and mirror data
     through mapped I/O units, keeping neighboring records intact when
     multiple records share a native 4Kn block. Track folio writeback
     until all BIOs complete, serialize raw record updates against
     writeback, and use the caller's requested completion mode.

   - Discard stale uninitialized cache data before extending initialized
     size, ensure shared mmap writes update initialized size after
     native 4Kn size extension, and synchronize attribute inode sizes
     after internal resizes. Keep VFS and NTFS sizes consistent when
     write-error rollback fails and record the volume error.

   - Wait for existing folio writeback before updating attribute data,
     require page alignment for full-page write optimizations, and
     include the final partial cluster in synchronous writes. Skip
     duplicate VFS page-cache truncation under the MFT record lock to
     avoid a truncate and writeback deadlock.

   - Restart allocation zone searches after failed hints and prevent
     contiguous allocation requests from returning additional disjoint
     runs that callers leave uninitialized. Allow fallocate after
     MFT-zone exhaustion and interrupt allocation loops only for fatal
     signals, avoiding spurious interruptions from io_uring task-work
     notifications.

   - Wait for the initial bitmap scan before extending the MFT bitmap,
     bound direct allocation candidates by the volume size, update
     free-space accounting, and undo only newly allocated clusters after
     run coalescing. Update attribute-list inode size before reserving
     additional space.

   - Hold runlist locks while expanding non-resident attributes, balance
     locks during MFT extension error handling, and avoid pointers
     invalidated by runlist reallocation. Keep source runlists available
     for rollback and allocate enough room for runlist markers and
     terminators.

   - Return errors for unmappable runlist fragments instead of treating
     them as holes or delayed allocation. Check non-resident attribute
     sizes against their allocation and fail mounts when $MFT needs
     extent records outside the decoded runlist to describe itself,
     preventing silent zero reads and mount hangs.

   - Load and validate $BadClus:$Bad at mount time and reserve known bad
     clusters before the free-space scan. Fall back to read-only
     operation when bad-cluster metadata cannot be validated and prevent
     subsequent read-write remounts.

   - Serialize volume flag updates and retain the dirty bit after
     metadata changes while the volume remains mounted read-write.
     Persist recorded errors after final metadata commits, fail ordinary
     read-only remounts on sync, commit, or flush errors, and retain the
     dirty bit on forced remounts.

   - Flush the device write cache when syncing directories and report
     flush failures from both file and directory fsync. Drain in-flight
     direct I/O before buffered write fallback and keep nonblocking
     requests from entering the blocking fallback path.

   - Mount hibernated volumes, or volumes whose hibernation state cannot
     be determined, read-only regardless of the errors= policy. Prevent
     mount-time and dirty-state updates from modifying hibernated
     volumes.

   - Validate complete EA chains, link zero-terminated tails when
     appending entries, retain the EA presence flag, and distinguish
     empty values from removal. Propagate lookup, write, and truncate
     errors, restore both EA attributes after failed updates, and shut
     down the volume if restoration fails.

   - Restore the previous ACL xattr when a subsequent WSL mode update
     fails, including replacement and removal cases. Record rollback
     failures so an unsuccessful permission change cannot silently leave
     inconsistent ACL and mode state.

   - Apply MST fixups to individual index blocks on large-page systems
     and use fixed 512-byte VCN units when an index block is smaller
     than its cluster. Support lookup and removal of POSIX names
     containing Windows-invalid characters and identify directory
     symlinks and junctions during enumeration.

   - Report the stored creation time for symbolic links through statx()
     when querying the link itself with AT_SYMLINK_NOFOLLOW.

   - Use wider decompression offsets to avoid overflow on 64 KB pages,
     accept the standard sparse compression unit, and require the
     compressed-size field only on the first attribute extent. Block
     direct reads and skip readahead for encrypted files to prevent
     returning raw ciphertext.

   - Validate index entry offsets, logfile update sequence array counts,
     attribute-list sizes, and index collation key lengths to prevent
     out-of-bounds accesses, NULL pointer dereferences, and excessive
     allocations from corrupt volume metadata.

   - Derive FITRIM bitmap indexes from the page size and retain the full
     64-bit minimum discard length. Balance highmem mappings in logfile
     and MFT mirror checks and propagate specific errors from extent,
     attribute, and reparse operations.

   - Compare streams_interface with the mounted volume's setting during
     remount, make named-stream UAPI padding explicit, document stream
     access and Linux file attributes, and add the NTFS UAPI header to
     MAINTAINERS"

* tag 'ntfs-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (93 commits)
  ntfs: handle a failed size rollback in the write error path
  ntfs: fix u16 truncation of the update sequence array count check
  ntfs: reject index blocks with a too small entries offset
  ntfs: support persistent noatime attribute
  ntfs: roll back the ACL xattr commit when the WSL mode update fails
  ntfs: report birth time for symbolic links
  ntfs: support FS_IOC_GETFSUUID
  ntfs: avoid unnecessary padding in uapi structure
  ntfs: flush the block device when syncing a directory
  ntfs: report block device flush failures from fsync
  ntfs: fix NULL dereference on index allocation open failure
  ntfs: compare streams_interface with mounted volume on remount
  ntfs: widen the sub-block offsets in ntfs_decompress()
  ntfs: reject direct I/O reads of encrypted files
  ntfs: do not read ahead encrypted files
  ntfs: persist nodump in the $LINUXFLAGS EA
  ntfs: persist append-only in the $LINUXFLAGS EA
  ntfs: persist immutable in the $LINUXFLAGS EA
  ntfs: add fileattr query support
  ntfs: restore EA attributes when an update fails
  ...

1 files changed, 130 insertions, 0 deletions

diff --git a/include/uapi/linux/ntfs.h b/include/uapi/linux/ntfs.h
new file mode 100644
index 000000000000..89467ba07262
--- /dev/null
+++ b/include/uapi/linux/ntfs.h
@@ -0,0 +1,130 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2026 LG Electronics Co., Ltd.
+ */
+
+#ifndef _UAPI_LINUX_NTFS_H
+#define _UAPI_LINUX_NTFS_H
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define NTFS_IOC_MAGIC	0xEF
+
+/*
+ * Flags for ntfs_stream.flags and ntfs_list_streams.flags.
+ *
+ * NTFS_STREAM_FL_UTF16 makes stream names raw UTF-16LE, exactly as stored on
+ * disk, instead of encoding them with the mounted filesystem NLS. This
+ * allows lossless round-tripping of stream names whose characters are not
+ * representable by the mount NLS (e.g. for Wine, which works in UTF-16
+ * natively). When set, the name length fields count bytes of UTF-16LE and
+ * must therefore be even.
+ */
+#define NTFS_STREAM_FL_UTF16		0x1
+
+/*
+ * ntfs named stream read, write, and remove ioctl structure.
+ *
+ * @stream_offset:	Offset within the named stream for read/write.
+ * @io_len:		Number of bytes to read/write. Must be zero for remove.
+ * @bytes_returned:	Actual bytes transferred on success (out).
+ * @name_len:		Stream name length in bytes, not including any
+ *			terminating NUL. When NTFS_STREAM_FL_UTF16 is set,
+ *			this counts UTF-16LE bytes and must be even.
+ * @flags:		Bit mask of NTFS_STREAM_FL_* flags. Other bits must
+ *			be zero.
+ * @reserved:		Must be zero.
+ * @buffer:		Bare stream name followed by stream data for read/write.
+ *
+ * The stream name is encoded with the mounted filesystem NLS, or as raw
+ * UTF-16LE when NTFS_STREAM_FL_UTF16 is set. A write creates the stream if
+ * it does not already exist. A write failure after creation may leave the
+ * new stream behind; it can be removed separately.
+ *
+ * For NTFS_IOC_STREAM_READ, a successful short read indicates EOF. If a read
+ * fails, the ioctl returns an error and copies no stream data to userspace.
+ *
+ * NTFS_IOC_STREAM_WRITE is not atomic. Write errors may leave partial data
+ * changes and an extended stream size. On error, bytes_returned is not valid.
+ * The ioctl does not report the completed byte count.
+ */
+struct ntfs_stream {
+	__aligned_u64 stream_offset;
+	__aligned_u64 io_len;
+	__aligned_u64 bytes_returned;
+	__u32 name_len;
+	__u32 flags;
+	__aligned_u64 reserved;
+	__u8 buffer[];
+};
+
+/*
+ * Single stream entry returned by NTFS_IOC_LIST_STREAMS.
+ *
+ * @next_entry_off:	Byte offset from the start of this entry to the next
+ *			entry, or zero for the last entry. Always a multiple
+ *			of 8. Consumers must use this to advance instead of
+ *			computing the stride themselves.
+ * @size:		Stream data size in bytes.
+ * @alloc_size:		Bytes allocated for the stream (cluster aligned for
+ *			non-resident streams).
+ * @name_len:		Stream name length in bytes, not including a NUL
+ *			terminator (none is stored). Counts UTF-16LE bytes
+ *			when NTFS_STREAM_FL_UTF16 was requested.
+ * @name_offset:	Byte offset from the start of this entry to @name.
+ * @reserved:		Must be zero.
+ * @name:		Bare stream name; NLS encoded, or raw UTF-16LE when
+ *			NTFS_STREAM_FL_UTF16 was requested.
+ *
+ * New fixed fields may be added after @reserved and before @name. Consumers
+ * must use @name_offset to locate the name and @next_entry_off to advance to
+ * the next entry.
+ */
+struct ntfs_stream_entry {
+	__aligned_u64 next_entry_off;
+	__aligned_u64 size;
+	__aligned_u64 alloc_size;
+	__u32 name_len;
+	__u32 name_offset;
+	__aligned_u64 reserved;
+	__u8 name[];
+};
+
+/*
+ * ntfs list streams ioctl structure.
+ *
+ * @buffer_size:	user buffer size(in).
+ * @bytes_returned:	actual bytes written or required(out).
+ * @stream_count:	number of streams(out).
+ * @flags:		Bit mask of NTFS_STREAM_FL_* flags controlling the
+ *			encoding of the returned names; other bits must be zero.
+ * @reserved:		Must be zero.
+ * @buffer:		ntfs_stream_entry array.
+ *
+ * The variable-length entries follow the header in @buffer, each aligned on
+ * an 8-byte boundary and chained via ntfs_stream_entry.next_entry_off. If
+ * @buffer_size is too small, no data is copied, @stream_count and
+ * @bytes_returned report the required values and the ioctl fails with
+ * -ENOSPC. In NLS mode, names that cannot be represented by the mounted
+ * character set are omitted; use NTFS_STREAM_FL_UTF16 to list all
+ * names without conversion loss.
+ */
+struct ntfs_list_streams {
+	__aligned_u64 buffer_size;
+	__aligned_u64 bytes_returned;
+	__aligned_u64 stream_count;
+	__u32 flags;
+	__u32 reserved;
+	__u8 buffer[];
+};
+
+#define NTFS_IOC_STREAM_READ \
+	_IOWR(NTFS_IOC_MAGIC, 1, struct ntfs_stream)
+#define NTFS_IOC_STREAM_WRITE \
+	_IOWR(NTFS_IOC_MAGIC, 2, struct ntfs_stream)
+#define NTFS_IOC_STREAM_REMOVE \
+	_IOWR(NTFS_IOC_MAGIC, 3, struct ntfs_stream)
+#define NTFS_IOC_LIST_STREAMS \
+	_IOWR(NTFS_IOC_MAGIC, 4, struct ntfs_list_streams)
+
+#endif /* _UAPI_LINUX_NTFS_H */