From nobody Thu Sep 24 14:27:13 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C6252D0C75; Wed, 23 Sep 2026 03:17:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133428; cv=none; b=U/98Wum1JJQqW95xSY6ctE9z9dzIekDgXnxjRk9j0/lVcan8Svyz92vJp8bj+LYab8xbbhAtVVHwM1K4WEbIOS900Q0dZ7arujGeXVIwrvgajh84Oi2wlemrPDjC7m4qyYsfxCdqlst5rpGGg8Dgk04vLa2sgiWdvc67B5q9yy4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133428; c=relaxed/simple; bh=wJQ9VpR5jQT42IcUxYFA1LXOKyQ0nuH0HzQQGQzeHxQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=AdOwDHVmVHR7zkkzrkfkL7uitqmTaIbC2VPs3R3IklYnnTLz1iAtS78z4uSPvHrMNBmFbt1IbXwrksOSMiTnhNDcaQP+XDIFo/gUFnQa52epUpyEpaku1IjZJKMqWsq85DQdMxcGURDsNf32Dn4FRNN1hLZ3AshER1WRaOGFkTU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=VWUOSqVU; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="VWUOSqVU" Received: from PC-202605011814.localdomain (unknown [221.228.238.82]) by smtp.qiye.163.com (Hmail) with ESMTP id 4eceabcf4; Wed, 23 Sep 2026 11:16:58 +0800 (GMT+08:00) From: Runyu Xiao To: Christoph Hellwig Cc: Sagi Grimberg , Chaitanya Kulkarni , Andreas Hindborg , Breno Leitao , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Runyu Xiao , Jianhao Xu Subject: [PATCH v5 1/3] fs: configfs: add helpers for opening non-configfs paths Date: Wed, 23 Sep 2026 11:16:39 +0800 Message-Id: <20260923031641.2016406-2-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> References: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0cc443ab103a1kunmae5dc6a4b63c6 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZHRhIVkkaQk5LHxlDSk8dS1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUpVSUlDVUlIQ1VDSVlXWRYaDxIVHRRZQVlPS0hVSktISk 9ITFVKS0tVSkJLS1kG DKIM-Signature: a=rsa-sha256; b=VWUOSqVUWJn7AS7X0KU29H8wj6nfxmD/w/bBSRlxMQqrqUkqdyx/pYCO2hqPwX7PYq66NWKa7J7w3EXcVnkir1vi8bCabZuGf9S062mmEivUE6WQrIp2ZkeL+pDHQvOVPKjHmQhWcby5lSgLctlLlpnSIgg4/WxxMmd64sPrejU=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=7ROA95LQ2XhQVA9V66ILPKJS6dG9LjRpy8RZm4OVovw=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" Configfs store callbacks run with the fragment semaphore of the item they belong to held for reading. A callback that opens a configfs path can re-enter __configfs_open_file(), which takes that same semaphore again on a non-recursive rwsem, and deadlock the task. Add a pair of helpers for such callbacks. configfs_file_open() resolves a configured pathname, rejects it if it resolves to configfs, and opens it. configfs_open_root() rejects a configfs root and opens relative to an already-resolved root, so a caller can validate a root once and keep opening files below it. The helpers compare the actual filesystem type and use file_open_root(), so the normal open-time permission and security checks still apply. Assisted-by: LLM Codex Signed-off-by: Runyu Xiao --- fs/configfs/mount.c | 68 ++++++++++++++++++++++++++++++++++++++++ include/linux/configfs.h | 5 +++ 2 files changed, 73 insertions(+) diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c index d8cac1cbf3bd5..b2c14cf6a4053 100644 --- a/fs/configfs/mount.c +++ b/fs/configfs/mount.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -118,6 +119,73 @@ static struct file_system_type configfs_fs_type =3D { }; MODULE_ALIAS_FS("configfs"); =20 +/** + * configfs_open_root - open a path relative to an already-resolved root + * @root: resolved root, which must not be on configfs + * @name: path to open relative to @root, or "" to open @root itself + * @flags: open flags as per the open(2) second argument + * @mode: mode argument passed to file_open_root() + * + * Open @name relative to @root, refusing a @root on configfs. + * + * Configfs store callbacks are called with the fragment semaphore of the + * item they belong to held for reading. Opening a configfs path from + * such a callback can re-enter __configfs_open_file() and take that same + * semaphore again, which is not recursive and deadlocks. Callers that + * open a user-configured path from a configfs store callback must + * therefore use this helper instead of filp_open() or a bare + * file_open_root(). + * + * Resolving @name relative to @root also lets a caller pin and validate a + * root once and keep opening files below it, rather than re-resolving a + * pathname that can be retargeted in the meantime. The normal open-time + * permission and security checks still apply to the file being opened. + * + * Return: the opened file, or an ERR_PTR() value. -EINVAL is returned if + * @root is on configfs. + */ +struct file *configfs_open_root(const struct path *root, const char *name, + int flags, umode_t mode) +{ + if (root->dentry->d_sb->s_type =3D=3D &configfs_fs_type) + return ERR_PTR(-EINVAL); + + return file_open_root(root, name, flags, mode); +} +EXPORT_SYMBOL_GPL(configfs_open_root); + +/** + * configfs_file_open - open a pathname that must not resolve to configfs + * @filename: existing pathname to resolve and open + * @flags: open flags as per the open(2) second argument + * @mode: mode argument passed to file_open_root() + * + * Resolve @filename and open the resulting file, refusing to open it if it + * resolves to configfs. @filename must already exist; this helper cannot + * create a missing path. Use this from configfs store callbacks that open + * a path configured by the user, in place of filp_open(). See + * configfs_open_root() for why opening configfs again from such a callback + * deadlocks. + * + * Return: the opened file, or an ERR_PTR() value. -EINVAL is returned if + * @filename resolves to configfs. + */ +struct file *configfs_file_open(const char *filename, int flags, umode_t m= ode) +{ + struct file *file; + struct path path; + int ret; + + ret =3D kern_path(filename, LOOKUP_FOLLOW, &path); + if (ret) + return ERR_PTR(ret); + + file =3D configfs_open_root(&path, "", flags, mode); + path_put(&path); + return file; +} +EXPORT_SYMBOL_GPL(configfs_file_open); + struct dentry *configfs_pin_fs(void) { int err =3D simple_pin_fs(&configfs_fs_type, &configfs_mount, diff --git a/include/linux/configfs.h b/include/linux/configfs.h index ef65c75beeaad..2a803bb836b4d 100644 --- a/include/linux/configfs.h +++ b/include/linux/configfs.h @@ -34,6 +34,8 @@ struct configfs_group_operations; struct configfs_attribute; struct configfs_bin_attribute; struct configfs_subsystem; +struct file; +struct path; =20 struct config_item { char *ci_name; @@ -243,6 +245,9 @@ void configfs_unregister_subsystem(struct configfs_subs= ystem *subsys); int configfs_register_group(struct config_group *parent_group, struct config_group *group); void configfs_unregister_group(struct config_group *group); +struct file *configfs_open_root(const struct path *root, const char *name, + int flags, umode_t mode); +struct file *configfs_file_open(const char *filename, int flags, umode_t m= ode); =20 void configfs_remove_default_groups(struct config_group *group); =20 --=20 2.34.1 From nobody Thu Sep 24 14:27:13 2026 Received: from mail-m49197.qiye.163.com (mail-m49197.qiye.163.com [45.254.49.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37E892F3C18; Wed, 23 Sep 2026 03:17:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133427; cv=none; b=YBAvhoFo4I18CscgOzlVFVAGIq2AZEm83fF8dzFiZZhE5R5yA7Ep8XDlL3M8BvAKCYorYfbjbtSFVI6uAwL+qrMLbR4LDHP47gkZXdZ/5Ne2TjJhGIo5ZmsgwP5QqEb1CF4UmLXtXN+llAgFjw4QWqT7HbzFt5GFM1xieaNk7Lk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133427; c=relaxed/simple; bh=N08GINapGkfvCosW7+xLnWZKpuPPjBW9LdLNoq/FvI0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=gyEHvJT0025tq3MFvJxxqrn8Kb2/I6FeUu+8OFOhUqjrhNmf68em6dQI3W2PLZu6RMG1cC4Cdf4M0mF9mlWZxPWToVDz8Y59CZ5YnMMP5XD8Ll0btTTDgcyd77HsL8A3iIXMTWaYnYnO6zJN5bnbTGN6DuE3418YXRqPIoVL9E8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=BwYb6Gc8; arc=none smtp.client-ip=45.254.49.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="BwYb6Gc8" Received: from PC-202605011814.localdomain (unknown [221.228.238.82]) by smtp.qiye.163.com (Hmail) with ESMTP id 4eceabcf6; Wed, 23 Sep 2026 11:16:59 +0800 (GMT+08:00) From: Runyu Xiao To: Christoph Hellwig Cc: Sagi Grimberg , Chaitanya Kulkarni , Andreas Hindborg , Breno Leitao , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Runyu Xiao , Jianhao Xu Subject: [PATCH v5 2/3] nvmet: avoid recursive configfs open for file-backed namespaces Date: Wed, 23 Sep 2026 11:16:40 +0800 Message-Id: <20260923031641.2016406-3-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> References: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0cc443f7903a1kunmae5dc6a4b63d0 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZGkoaVkJLGBhJSU4aSBpPGlYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUpVSUlDVUlIQ1VDSVlXWRYaDxIVHRRZQVlPS0hVSktISk 9ITFVKS0tVSkJLS1kG DKIM-Signature: a=rsa-sha256; b=BwYb6Gc8YZO9ie5MNryXP7j36pNofo90dkrWO7H1yStiU3h7yX1q42MdtevTXGIroHI2GQCJ30+pp1D/qQ2PolQwtn5ntY0nlX1AUy/b0+1prOQ2Vk1oMd2PmlZ/zrQ5mHjh7PselsanUkJJmRY6mACPqcml2EPTcoY+GZyECdo=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=Tcbi5MYjrLiwUZJP1iBOkaEwqrphN9t9A1anWrBn1xQ=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" nvmet_ns_enable_store() runs as a configfs store callback while configfs holds the item frag_sem. File-backed namespace enable used filp_open() on the configured device_path, so a path into configfs could re-enter __configfs_open_file() and try to acquire the same semaphore again. Use configfs_file_open() so the path is resolved before opening, configfs-backed paths are rejected, and the resolved path is opened with file_open_root() while retaining the normal open-time permission and security checks. Fixes: d5eff33ee6f8 ("nvmet: add simple file backed ns support") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Assisted-by: LLM Codex Signed-off-by: Runyu Xiao --- drivers/nvme/target/io-cmd-file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd= -file.c index 0b22d183f9279..2a4f25de94ba1 100644 --- a/drivers/nvme/target/io-cmd-file.c +++ b/drivers/nvme/target/io-cmd-file.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include "nvmet.h" =20 @@ -38,7 +39,7 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) if (!ns->buffered_io) flags |=3D O_DIRECT; =20 - ns->file =3D filp_open(ns->device_path, flags, 0); + ns->file =3D configfs_file_open(ns->device_path, flags, 0); if (IS_ERR(ns->file)) { ret =3D PTR_ERR(ns->file); pr_err("failed to open file %s: (%d)\n", --=20 2.34.1 From nobody Thu Sep 24 14:27:13 2026 Received: from mail-m155101.qiye.163.com (mail-m155101.qiye.163.com [101.71.155.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C6192FDC20; Wed, 23 Sep 2026 03:17:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.71.155.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133427; cv=none; b=iHNlZL+LcB3msaRXYKx3cWqQuehCMkDXhXsOqFrQut9ANxuImSyjlz8mnSgIgn0fom0mfmK0pfCphxJNiOV3BpSXmEzZ3VjVVfcCKvlOuepFDPLmvid/jjLD99gzM+pmNmy54DC3Adf3q0kA5Bhp6IcZtElzUrWRVaHrpN9mpAE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790133427; c=relaxed/simple; bh=gwbthItRhuypYUcH713iH/hnNoRFDlBtn4qTU9lz7/M=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=JSVzczjggsCqg76xhRJ2OEMkpnWbFkxLUoVXJTdDpSXKLu9k3B90Mhwx3KbazfeUoJV4FzJVHaQG9FNLANUKE7GRg+8R3jULqNnoQJcbqYIxKZK/8xSsf8+J6FlP5q8l1Di8IaB/yC11xFMul/5jNf5eMIdSwP11lBcTftpleXU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=BPRNp5/r; arc=none smtp.client-ip=101.71.155.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="BPRNp5/r" Received: from PC-202605011814.localdomain (unknown [221.228.238.82]) by smtp.qiye.163.com (Hmail) with ESMTP id 4eceabcf7; Wed, 23 Sep 2026 11:17:01 +0800 (GMT+08:00) From: Runyu Xiao To: Christoph Hellwig Cc: Sagi Grimberg , Chaitanya Kulkarni , Andreas Hindborg , Breno Leitao , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Runyu Xiao , Jianhao Xu Subject: [PATCH v5 3/3] nvmet: avoid recursive configfs open for passthru Date: Wed, 23 Sep 2026 11:16:41 +0800 Message-Id: <20260923031641.2016406-4-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> References: <20260923031641.2016406-1-runyu.xiao@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0cc4443f703a1kunmae5dc6a4b63d6 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZTUoeVktPT0seTElKGRpPTVYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUpVSUlDVUlIQ1VDSVlXWRYaDxIVHRRZQVlPS0hVSktISk 9ITFVKS0tVSkJLS1kG DKIM-Signature: a=rsa-sha256; b=BPRNp5/rOowzhJB5OAAhZuwfO1z6RQuh+iMqN8GyCGNByo/B7ULXU+iUCSTfu2mU0Qw9NhJfVoTz3xUQ0Lq299GElYruh3IKuhU776IUND8LbDYJxAj+VAEM0zs5xGZXsQ87Ry4jtwvhs1F1XQTbAHtA2hCgNhPzO6Sq9E8uC20=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=/H/LFwbci3Eh6MNU8eJOEho61nt5VkkYkF/xMDqVmas=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" nvmet_passthru_enable_store() runs as a configfs store callback while configfs holds the item frag_sem. Passthru enable used filp_open() on the configured controller path, so a path into configfs could re-enter __configfs_open_file() and try to acquire the same semaphore again. Use configfs_file_open() so the path is resolved before opening, configfs-backed paths are rejected, and the resolved path is opened with file_open_root() while retaining the normal open-time permission and security checks. Fixes: cae5b01a2afc ("nvmet: introduce the passthru configfs interface") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Assisted-by: LLM Codex Signed-off-by: Runyu Xiao --- drivers/nvme/target/passthru.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c index fa6527c537e26..d60256004e6cf 100644 --- a/drivers/nvme/target/passthru.c +++ b/drivers/nvme/target/passthru.c @@ -9,6 +9,7 @@ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include +#include =20 #include "../host/nvme.h" #include "nvmet.h" @@ -602,7 +603,7 @@ int nvmet_passthru_ctrl_enable(struct nvmet_subsys *sub= sys) goto out_unlock; } =20 - file =3D filp_open(subsys->passthru_ctrl_path, O_RDWR, 0); + file =3D configfs_file_open(subsys->passthru_ctrl_path, O_RDWR, 0); if (IS_ERR(file)) { ret =3D PTR_ERR(file); goto out_unlock; --=20 2.34.1