kernfs: three standalone fixes

[PATCH v2 0/4] kernfs: three standalone fixes

Posted by Shakeel Butt 2 weeks, 6 days ago

Three independent kernfs fixes, plus selftest coverage for the paths
they touch.  The fixes do not depend on each other.

Patch 1 adds tests for decoding a file handle and for a rename that
keeps the same parent.  Patches 2-4:

 - kernfs_rename_ns() takes kernfs_rename_lock only when the parent
   changes, so two same-parent renames inside one
   kernfs_path_from_node() walk can build a path that never existed.
   sysfs_warn_dup() is the only caller that can see it.

 - __kernfs_fh_to_dentry() creates inodes with no lock, so a decode
   racing rmdir() can hash an inode after the removal's ilookup()
   pass.  The inode keeps i_nlink 1, so no IN_DELETE_SELF is sent.

 - kernfs_create_link() reads the target's uid and gid unlocked, so a
   chown in between gives the link an owner the target never had.

Patch 1 applies on top of the patch [1] ("selftests: cover kernfs
dentry revalidation") with vfs-7.4.kernfs branch in vfs tree as base.

[1] http://lore.kernel.org/20260902014050.499002-1-shakeel.butt@linux.dev

Changes since v1:
http://lore.kernel.org/20260903040253.670020-1-shakeel.butt@linux.dev
- Added cover letter
- Used approppriate tags
- Updated commit messages to be more concise
- Replaced data_race() with READ_ONCE() (TJ)

Shakeel Butt (4):
  selftests: cover kernfs file handles and same-parent rename
  kernfs: take kernfs_rename_lock for same-parent renames too
  kernfs: don't lose IN_DELETE_SELF when decoding a file handle
  kernfs: fix up the unlocked attribute reads on the creation paths

 fs/kernfs/dir.c                               |  40 ++-
 fs/kernfs/kernfs-internal.h                   |   9 +-
 fs/kernfs/mount.c                             |  32 +-
 fs/kernfs/symlink.c                           |  17 +-
 tools/testing/selftests/filesystems/config    |   1 +
 .../selftests/filesystems/kernfs_test.c       | 296 +++++++++++++++++-
 6 files changed, 362 insertions(+), 33 deletions(-)


base-commit: 47fc64fb3b433abb9f2242a85ba808ac6f87df22
-- 
2.53.0-Meta

Re: [PATCH v2 0/4] kernfs: three standalone fixes

Posted by Christian Brauner 2 weeks, 1 day ago

On Sat, 05 Sep 2026 12:16:09 -0700, Shakeel Butt wrote:
> kernfs: three standalone fixes
> 
> Three independent kernfs fixes, plus selftest coverage for the paths
> they touch.  The fixes do not depend on each other.
> 
> Patch 1 adds tests for decoding a file handle and for a rename that
> keeps the same parent.  Patches 2-4:
> 
> [...]

Applied to the vfs-7.4.kernfs branch of the vfs/vfs.git tree.
Patches in the vfs-7.4.kernfs branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs-7.4.kernfs

[1/4] selftests: cover kernfs file handles and same-parent rename
      https://git.kernel.org/vfs/vfs/c/60da22a38b01
[2/4] kernfs: take kernfs_rename_lock for same-parent renames too
      https://git.kernel.org/vfs/vfs/c/6034974e3aec
[3/4] kernfs: don't lose IN_DELETE_SELF when decoding a file handle
      https://git.kernel.org/vfs/vfs/c/dc1a0cc95737
[4/4] kernfs: fix up the unlocked attribute reads on the creation paths
      https://git.kernel.org/vfs/vfs/c/81bdc85b4c08