* [PATCH v5 1/2] fanotify: report thread pidfds for FAN_REPORT_TID
2026-06-07 0:33 [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions AnonymeMeow
@ 2026-06-07 0:33 ` AnonymeMeow
2026-06-07 0:33 ` [PATCH v5 2/2] fanotify: allow reporting pidfds for reaped tasks AnonymeMeow
2026-06-09 10:29 ` [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions Jan Kara
2 siblings, 0 replies; 6+ messages in thread
From: AnonymeMeow @ 2026-06-07 0:33 UTC (permalink / raw)
To: jack; +Cc: amir73il, brauner, linux-fsdevel, linux-kernel, AnonymeMeow
The FAN_REPORT_PIDFD and FAN_REPORT_TID flags used to be mutually
exclusive because by the time the pidfd support was introduced to
fanotify, pidfds could only be created for thread group leaders. Now
that the pidfd API supports thread-specific pidfds via PIDFD_THREAD,
this restriction can be lifted.
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: AnonymeMeow <anonymemeow@gmail.com>
---
fs/notify/fanotify/fanotify_user.c | 27 ++++++++-------------------
1 file changed, 8 insertions(+), 19 deletions(-)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ae904451dfc0..ebdd48942029 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -19,6 +19,7 @@
#include <linux/memcontrol.h>
#include <linux/statfs.h>
#include <linux/exportfs.h>
+#include <linux/pidfd.h>
#include <asm/ioctls.h>
@@ -903,25 +904,21 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
metadata.fd = fd >= 0 ? fd : FAN_NOFD;
if (pidfd_mode) {
- /*
- * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual
- * exclusion is ever lifted. At the time of incoporating pidfd
- * support within fanotify, the pidfd API only supported the
- * creation of pidfds for thread-group leaders.
- */
- WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID));
+ unsigned int tid_mode = FAN_GROUP_FLAG(group, FAN_REPORT_TID);
+ enum pid_type pidtype = tid_mode ? PIDTYPE_PID : PIDTYPE_TGID;
+ unsigned int pidfd_flags = tid_mode ? PIDFD_THREAD : 0;
/*
- * The PIDTYPE_TGID check for an event->pid is performed
+ * The pid_has_task() check for an event->pid is performed
* preemptively in an attempt to catch out cases where the event
- * listener reads events after the event generating process has
+ * listener reads events after the event generating task has
* already terminated. Depending on flag FAN_REPORT_FD_ERROR,
* report either -ESRCH or FAN_NOPIDFD to the event listener in
* those cases with all other pidfd creation errors reported as
* the error code itself or as FAN_EPIDFD.
*/
- if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID))
- pidfd = pidfd_prepare(event->pid, 0, &pidfd_file);
+ if (metadata.pid && pid_has_task(event->pid, pidtype))
+ pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file);
if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD;
@@ -1628,14 +1625,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
#endif
return -EINVAL;
- /*
- * A pidfd can only be returned for a thread-group leader; thus
- * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually
- * exclusive.
- */
- if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID))
- return -EINVAL;
-
/* Don't allow mixing mnt events with inode events for now */
if (flags & FAN_REPORT_MNT) {
if (class != FAN_CLASS_NOTIF)
--
2.54.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v5 2/2] fanotify: allow reporting pidfds for reaped tasks
2026-06-07 0:33 [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions AnonymeMeow
2026-06-07 0:33 ` [PATCH v5 1/2] fanotify: report thread pidfds for FAN_REPORT_TID AnonymeMeow
@ 2026-06-07 0:33 ` AnonymeMeow
2026-06-09 10:29 ` [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions Jan Kara
2 siblings, 0 replies; 6+ messages in thread
From: AnonymeMeow @ 2026-06-07 0:33 UTC (permalink / raw)
To: jack; +Cc: amir73il, brauner, linux-fsdevel, linux-kernel, AnonymeMeow
Fanotify used to refuse to report pidfds for reaped tasks by applying a
pid_has_task() check before calling pidfd_prepare(). This prevented
userspace from obtaining information about the task.
Register the event pid with pidfs when creating the fanotify event if
pidfd reporting was requested, so pidfd_prepare() can later create a
pidfd for the reaped task.
Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/linux-fsdevel/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
Signed-off-by: AnonymeMeow <anonymemeow@gmail.com>
---
fs/notify/fanotify/fanotify.c | 17 +++++++++++------
fs/notify/fanotify/fanotify_user.c | 18 +++++-------------
fs/pidfs.c | 10 ++++++----
include/linux/pidfs.h | 18 +++++++++++++++++-
4 files changed, 39 insertions(+), 24 deletions(-)
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 38290b9c07f7..ece9523e775b 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -14,6 +14,7 @@
#include <linux/sched/mm.h>
#include <linux/statfs.h>
#include <linux/stringhash.h>
+#include <linux/pidfs.h>
#include "fanotify.h"
@@ -842,6 +843,15 @@ static struct fanotify_event *fanotify_alloc_event(
/* Whoever is interested in the event, pays for the allocation. */
old_memcg = set_active_memcg(group->memcg);
+ if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+ pid = task_pid(current);
+ else
+ pid = task_tgid(current);
+
+ if (FAN_GROUP_FLAG(group, FAN_REPORT_PIDFD) &&
+ pidfs_register_pid_gfp(pid, gfp))
+ goto out;
+
if (fanotify_is_perm_event(mask)) {
event = fanotify_alloc_perm_event(data, data_type, gfp);
} else if (fanotify_is_error_event(mask)) {
@@ -863,15 +873,10 @@ static struct fanotify_event *fanotify_alloc_event(
if (!event)
goto out;
- if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
- pid = get_pid(task_pid(current));
- else
- pid = get_pid(task_tgid(current));
-
/* Mix event info, FAN_ONDIR flag and pid into event merge key */
hash ^= hash_long((unsigned long)pid | ondir, FANOTIFY_EVENT_HASH_BITS);
fanotify_init_event(event, hash, mask);
- event->pid = pid;
+ event->pid = get_pid(pid);
out:
set_active_memcg(old_memcg);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ebdd48942029..b604e3da58ad 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -904,20 +904,12 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
metadata.fd = fd >= 0 ? fd : FAN_NOFD;
if (pidfd_mode) {
- unsigned int tid_mode = FAN_GROUP_FLAG(group, FAN_REPORT_TID);
- enum pid_type pidtype = tid_mode ? PIDTYPE_PID : PIDTYPE_TGID;
- unsigned int pidfd_flags = tid_mode ? PIDFD_THREAD : 0;
+ unsigned int pidfd_flags = PIDFD_STALE;
- /*
- * The pid_has_task() check for an event->pid is performed
- * preemptively in an attempt to catch out cases where the event
- * listener reads events after the event generating task has
- * already terminated. Depending on flag FAN_REPORT_FD_ERROR,
- * report either -ESRCH or FAN_NOPIDFD to the event listener in
- * those cases with all other pidfd creation errors reported as
- * the error code itself or as FAN_EPIDFD.
- */
- if (metadata.pid && pid_has_task(event->pid, pidtype))
+ if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+ pidfd_flags |= PIDFD_THREAD;
+
+ if (metadata.pid)
pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file);
if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
diff --git a/fs/pidfs.c b/fs/pidfs.c
index 1cce4f34a051..15efecf5cb07 100644
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -991,14 +991,16 @@ static void pidfs_put_data(void *data)
}
/**
- * pidfs_register_pid - register a struct pid in pidfs
+ * pidfs_register_pid_gfp - register a struct pid in pidfs with custom GFP
+ * flags
* @pid: pid to pin
+ * @gfp: GFP flags for memory allocation
*
- * Register a struct pid in pidfs.
+ * Register a struct pid in pidfs with custom GFP flags.
*
* Return: On success zero, on error a negative error code is returned.
*/
-int pidfs_register_pid(struct pid *pid)
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp)
{
struct pidfs_attr *new_attr __free(kfree) = NULL;
struct pidfs_attr *attr;
@@ -1014,7 +1016,7 @@ int pidfs_register_pid(struct pid *pid)
if (attr)
return 0;
- new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL);
+ new_attr = kmem_cache_zalloc(pidfs_attr_cachep, gfp);
if (!new_attr)
return -ENOMEM;
diff --git a/include/linux/pidfs.h b/include/linux/pidfs.h
index 416bdff4d6ce..0abf7da9ab23 100644
--- a/include/linux/pidfs.h
+++ b/include/linux/pidfs.h
@@ -2,6 +2,8 @@
#ifndef _LINUX_PID_FS_H
#define _LINUX_PID_FS_H
+#include <linux/gfp_types.h>
+
struct coredump_params;
struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags);
@@ -14,7 +16,21 @@ void pidfs_exit(struct task_struct *tsk);
void pidfs_coredump(const struct coredump_params *cprm);
#endif
extern const struct dentry_operations pidfs_dentry_operations;
-int pidfs_register_pid(struct pid *pid);
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp);
+
+/**
+ * pidfs_register_pid - register a struct pid in pidfs
+ * @pid: pid to pin
+ *
+ * Register a struct pid in pidfs.
+ *
+ * Return: On success zero, on error a negative error code is returned.
+ */
+static inline int pidfs_register_pid(struct pid *pid)
+{
+ return pidfs_register_pid_gfp(pid, GFP_KERNEL);
+}
+
void pidfs_free_pid(struct pid *pid);
#endif /* _LINUX_PID_FS_H */
--
2.54.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions
2026-06-07 0:33 [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions AnonymeMeow
2026-06-07 0:33 ` [PATCH v5 1/2] fanotify: report thread pidfds for FAN_REPORT_TID AnonymeMeow
2026-06-07 0:33 ` [PATCH v5 2/2] fanotify: allow reporting pidfds for reaped tasks AnonymeMeow
@ 2026-06-09 10:29 ` Jan Kara
2026-06-10 7:31 ` Christian Brauner
2 siblings, 1 reply; 6+ messages in thread
From: Jan Kara @ 2026-06-09 10:29 UTC (permalink / raw)
To: AnonymeMeow; +Cc: jack, amir73il, brauner, linux-fsdevel, linux-kernel
On Sun 07-06-26 08:33:41, AnonymeMeow wrote:
> The pidfd API now supports pidfds for tasks that are not thread group leaders,
> but fanotify has not caught up yet. This patch set lifts that restriction and
> allows fanotify to report pidfds referring to the event-generating thread.
>
> Additionally, this patch set allows fanotify to hand out pidfds for reaped
> tasks by registering the event pid with pidfs when pidfd reporting is
> requested and dropping the pid_has_task() check before the pidfd_prepare()
> call, as suggested by Christian.
>
> Link: https://lore.kernel.org/lkml/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
> Link: https://lore.kernel.org/lkml/20260602-patzt-sturz-segen-f1f305d61b75@brauner/
>
> Changes since v4:
> - Add a pidfs_register_pid_gfp() helper function to pass in custom flags.
>
> v4: https://lore.kernel.org/lkml/20260603001516.26234-1-anonymemeow@gmail.com/
The patches look good to me. Thanks! I'd prefer the change adding gfp
argument to pidfs_register_pid() was a separate commit but unless Christian
objects I can live with that. I'll wait for Christian's ack for pidfs
changes before merging this through my tree.
Honza
> AnonymeMeow (2):
> fanotify: report thread pidfds for FAN_REPORT_TID
> fanotify: allow reporting pidfds for reaped tasks
>
> fs/notify/fanotify/fanotify.c | 17 +++++++++------
> fs/notify/fanotify/fanotify_user.c | 33 +++++++-----------------------
> fs/pidfs.c | 10 +++++----
> include/linux/pidfs.h | 18 +++++++++++++++-
> 4 files changed, 41 insertions(+), 37 deletions(-)
>
> --
> 2.54.0
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 6+ messages in thread