[PATCH v5 0/2] fanotify: lift pidfd reporting restrictions

[PATCH v5 0/2] fanotify: lift pidfd reporting restrictions

[AnonymeMeow]

The pidfd API now supports pidfds for tasks that are not thread group leaders,
but fanotify has not caught up yet. This patch set lifts that restriction and
allows fanotify to report pidfds referring to the event-generating thread.

Additionally, this patch set allows fanotify to hand out pidfds for reaped
tasks by registering the event pid with pidfs when pidfd reporting is
requested and dropping the pid_has_task() check before the pidfd_prepare()
call, as suggested by Christian.

Link: https://lore.kernel.org/lkml/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
Link: https://lore.kernel.org/lkml/20260602-patzt-sturz-segen-f1f305d61b75@brauner/

Changes since v4:
 - Add a pidfs_register_pid_gfp() helper function to pass in custom flags.

v4: https://lore.kernel.org/lkml/20260603001516.26234-1-anonymemeow@gmail.com/

AnonymeMeow (2):
  fanotify: report thread pidfds for FAN_REPORT_TID
  fanotify: allow reporting pidfds for reaped tasks

 fs/notify/fanotify/fanotify.c      | 17 +++++++++------
 fs/notify/fanotify/fanotify_user.c | 33 +++++++-----------------------
 fs/pidfs.c                         | 10 +++++----
 include/linux/pidfs.h              | 18 +++++++++++++++-
 4 files changed, 41 insertions(+), 37 deletions(-)

-- 
2.54.0

[PATCH v5 1/2] fanotify: report thread pidfds for FAN_REPORT_TID

[AnonymeMeow]

The FAN_REPORT_PIDFD and FAN_REPORT_TID flags used to be mutually
exclusive because by the time the pidfd support was introduced to
fanotify, pidfds could only be created for thread group leaders. Now
that the pidfd API supports thread-specific pidfds via PIDFD_THREAD,
this restriction can be lifted.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: AnonymeMeow <anonymemeow@gmail.com>
---
 fs/notify/fanotify/fanotify_user.c | 27 ++++++++-------------------
 1 file changed, 8 insertions(+), 19 deletions(-)

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ae904451dfc0..ebdd48942029 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -19,6 +19,7 @@
 #include <linux/memcontrol.h>
 #include <linux/statfs.h>
 #include <linux/exportfs.h>
+#include <linux/pidfd.h>
 
 #include <asm/ioctls.h>
 
@@ -903,25 +904,21 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
 		metadata.fd = fd >= 0 ? fd : FAN_NOFD;
 
 	if (pidfd_mode) {
-		/*
-		 * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual
-		 * exclusion is ever lifted. At the time of incoporating pidfd
-		 * support within fanotify, the pidfd API only supported the
-		 * creation of pidfds for thread-group leaders.
-		 */
-		WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID));
+		unsigned int tid_mode = FAN_GROUP_FLAG(group, FAN_REPORT_TID);
+		enum pid_type pidtype = tid_mode ? PIDTYPE_PID : PIDTYPE_TGID;
+		unsigned int pidfd_flags = tid_mode ? PIDFD_THREAD : 0;
 
 		/*
-		 * The PIDTYPE_TGID check for an event->pid is performed
+		 * The pid_has_task() check for an event->pid is performed
 		 * preemptively in an attempt to catch out cases where the event
-		 * listener reads events after the event generating process has
+		 * listener reads events after the event generating task has
 		 * already terminated.  Depending on flag FAN_REPORT_FD_ERROR,
 		 * report either -ESRCH or FAN_NOPIDFD to the event listener in
 		 * those cases with all other pidfd creation errors reported as
 		 * the error code itself or as FAN_EPIDFD.
 		 */
-		if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID))
-			pidfd = pidfd_prepare(event->pid, 0, &pidfd_file);
+		if (metadata.pid && pid_has_task(event->pid, pidtype))
+			pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file);
 
 		if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
 			pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD;
@@ -1628,14 +1625,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 #endif
 		return -EINVAL;
 
-	/*
-	 * A pidfd can only be returned for a thread-group leader; thus
-	 * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually
-	 * exclusive.
-	 */
-	if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID))
-		return -EINVAL;
-
 	/* Don't allow mixing mnt events with inode events for now */
 	if (flags & FAN_REPORT_MNT) {
 		if (class != FAN_CLASS_NOTIF)
-- 
2.54.0

[PATCH v5 2/2] fanotify: allow reporting pidfds for reaped tasks

[AnonymeMeow]

Fanotify used to refuse to report pidfds for reaped tasks by applying a
pid_has_task() check before calling pidfd_prepare(). This prevented
userspace from obtaining information about the task.

Register the event pid with pidfs when creating the fanotify event if
pidfd reporting was requested, so pidfd_prepare() can later create a
pidfd for the reaped task.

Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/linux-fsdevel/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/

Signed-off-by: AnonymeMeow <anonymemeow@gmail.com>
---
 fs/notify/fanotify/fanotify.c      | 17 +++++++++++------
 fs/notify/fanotify/fanotify_user.c | 18 +++++-------------
 fs/pidfs.c                         | 10 ++++++----
 include/linux/pidfs.h              | 18 +++++++++++++++++-
 4 files changed, 39 insertions(+), 24 deletions(-)

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 38290b9c07f7..ece9523e775b 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -14,6 +14,7 @@
 #include <linux/sched/mm.h>
 #include <linux/statfs.h>
 #include <linux/stringhash.h>
+#include <linux/pidfs.h>
 
 #include "fanotify.h"
 
@@ -842,6 +843,15 @@ static struct fanotify_event *fanotify_alloc_event(
 	/* Whoever is interested in the event, pays for the allocation. */
 	old_memcg = set_active_memcg(group->memcg);
 
+	if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+		pid = task_pid(current);
+	else
+		pid = task_tgid(current);
+
+	if (FAN_GROUP_FLAG(group, FAN_REPORT_PIDFD) &&
+	    pidfs_register_pid_gfp(pid, gfp))
+		goto out;
+
 	if (fanotify_is_perm_event(mask)) {
 		event = fanotify_alloc_perm_event(data, data_type, gfp);
 	} else if (fanotify_is_error_event(mask)) {
@@ -863,15 +873,10 @@ static struct fanotify_event *fanotify_alloc_event(
 	if (!event)
 		goto out;
 
-	if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
-		pid = get_pid(task_pid(current));
-	else
-		pid = get_pid(task_tgid(current));
-
 	/* Mix event info, FAN_ONDIR flag and pid into event merge key */
 	hash ^= hash_long((unsigned long)pid | ondir, FANOTIFY_EVENT_HASH_BITS);
 	fanotify_init_event(event, hash, mask);
-	event->pid = pid;
+	event->pid = get_pid(pid);
 
 out:
 	set_active_memcg(old_memcg);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ebdd48942029..b604e3da58ad 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -904,20 +904,12 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
 		metadata.fd = fd >= 0 ? fd : FAN_NOFD;
 
 	if (pidfd_mode) {
-		unsigned int tid_mode = FAN_GROUP_FLAG(group, FAN_REPORT_TID);
-		enum pid_type pidtype = tid_mode ? PIDTYPE_PID : PIDTYPE_TGID;
-		unsigned int pidfd_flags = tid_mode ? PIDFD_THREAD : 0;
+		unsigned int pidfd_flags = PIDFD_STALE;
 
-		/*
-		 * The pid_has_task() check for an event->pid is performed
-		 * preemptively in an attempt to catch out cases where the event
-		 * listener reads events after the event generating task has
-		 * already terminated.  Depending on flag FAN_REPORT_FD_ERROR,
-		 * report either -ESRCH or FAN_NOPIDFD to the event listener in
-		 * those cases with all other pidfd creation errors reported as
-		 * the error code itself or as FAN_EPIDFD.
-		 */
-		if (metadata.pid && pid_has_task(event->pid, pidtype))
+		if (FAN_GROUP_FLAG(group, FAN_REPORT_TID))
+			pidfd_flags |= PIDFD_THREAD;
+
+		if (metadata.pid)
 			pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file);
 
 		if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
diff --git a/fs/pidfs.c b/fs/pidfs.c
index 1cce4f34a051..15efecf5cb07 100644
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -991,14 +991,16 @@ static void pidfs_put_data(void *data)
 }
 
 /**
- * pidfs_register_pid - register a struct pid in pidfs
+ * pidfs_register_pid_gfp - register a struct pid in pidfs with custom GFP
+ * flags
  * @pid: pid to pin
+ * @gfp: GFP flags for memory allocation
  *
- * Register a struct pid in pidfs.
+ * Register a struct pid in pidfs with custom GFP flags.
  *
  * Return: On success zero, on error a negative error code is returned.
  */
-int pidfs_register_pid(struct pid *pid)
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp)
 {
 	struct pidfs_attr *new_attr __free(kfree) = NULL;
 	struct pidfs_attr *attr;
@@ -1014,7 +1016,7 @@ int pidfs_register_pid(struct pid *pid)
 	if (attr)
 		return 0;
 
-	new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL);
+	new_attr = kmem_cache_zalloc(pidfs_attr_cachep, gfp);
 	if (!new_attr)
 		return -ENOMEM;
 
diff --git a/include/linux/pidfs.h b/include/linux/pidfs.h
index 416bdff4d6ce..0abf7da9ab23 100644
--- a/include/linux/pidfs.h
+++ b/include/linux/pidfs.h
@@ -2,6 +2,8 @@
 #ifndef _LINUX_PID_FS_H
 #define _LINUX_PID_FS_H
 
+#include <linux/gfp_types.h>
+
 struct coredump_params;
 
 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags);
@@ -14,7 +16,21 @@ void pidfs_exit(struct task_struct *tsk);
 void pidfs_coredump(const struct coredump_params *cprm);
 #endif
 extern const struct dentry_operations pidfs_dentry_operations;
-int pidfs_register_pid(struct pid *pid);
+int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp);
+
+/**
+ * pidfs_register_pid - register a struct pid in pidfs
+ * @pid: pid to pin
+ *
+ * Register a struct pid in pidfs.
+ *
+ * Return: On success zero, on error a negative error code is returned.
+ */
+static inline int pidfs_register_pid(struct pid *pid)
+{
+	return pidfs_register_pid_gfp(pid, GFP_KERNEL);
+}
+
 void pidfs_free_pid(struct pid *pid);
 
 #endif /* _LINUX_PID_FS_H */
-- 
2.54.0

Re: [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions

[Jan Kara]

On Sun 07-06-26 08:33:41, AnonymeMeow wrote:
> The pidfd API now supports pidfds for tasks that are not thread group leaders,
> but fanotify has not caught up yet. This patch set lifts that restriction and
> allows fanotify to report pidfds referring to the event-generating thread.
> 
> Additionally, this patch set allows fanotify to hand out pidfds for reaped
> tasks by registering the event pid with pidfs when pidfd reporting is
> requested and dropping the pid_has_task() check before the pidfd_prepare()
> call, as suggested by Christian.
> 
> Link: https://lore.kernel.org/lkml/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
> Link: https://lore.kernel.org/lkml/20260602-patzt-sturz-segen-f1f305d61b75@brauner/
> 
> Changes since v4:
>  - Add a pidfs_register_pid_gfp() helper function to pass in custom flags.
> 
> v4: https://lore.kernel.org/lkml/20260603001516.26234-1-anonymemeow@gmail.com/

The patches look good to me. Thanks! I'd prefer the change adding gfp
argument to pidfs_register_pid() was a separate commit but unless Christian
objects I can live with that. I'll wait for Christian's ack for pidfs
changes before merging this through my tree.
								Honza

> AnonymeMeow (2):
>   fanotify: report thread pidfds for FAN_REPORT_TID
>   fanotify: allow reporting pidfds for reaped tasks
> 
>  fs/notify/fanotify/fanotify.c      | 17 +++++++++------
>  fs/notify/fanotify/fanotify_user.c | 33 +++++++-----------------------
>  fs/pidfs.c                         | 10 +++++----
>  include/linux/pidfs.h              | 18 +++++++++++++++-
>  4 files changed, 41 insertions(+), 37 deletions(-)
> 
> -- 
> 2.54.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions

[Christian Brauner]

On Tue, Jun 09, 2026 at 12:29:05PM +0200, Jan Kara wrote:
> On Sun 07-06-26 08:33:41, AnonymeMeow wrote:
> > The pidfd API now supports pidfds for tasks that are not thread group leaders,
> > but fanotify has not caught up yet. This patch set lifts that restriction and
> > allows fanotify to report pidfds referring to the event-generating thread.
> > 
> > Additionally, this patch set allows fanotify to hand out pidfds for reaped
> > tasks by registering the event pid with pidfs when pidfd reporting is
> > requested and dropping the pid_has_task() check before the pidfd_prepare()
> > call, as suggested by Christian.
> > 
> > Link: https://lore.kernel.org/lkml/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
> > Link: https://lore.kernel.org/lkml/20260602-patzt-sturz-segen-f1f305d61b75@brauner/
> > 
> > Changes since v4:
> >  - Add a pidfs_register_pid_gfp() helper function to pass in custom flags.
> > 
> > v4: https://lore.kernel.org/lkml/20260603001516.26234-1-anonymemeow@gmail.com/
> 
> The patches look good to me. Thanks! I'd prefer the change adding gfp
> argument to pidfs_register_pid() was a separate commit but unless Christian
> objects I can live with that. I'll wait for Christian's ack for pidfs

I would also prefer it to be a separate commit but same as you I'm not
gonna insist. :)

> changes before merging this through my tree.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Re: [PATCH v5 0/2] fanotify: lift pidfd reporting restrictions

[Jan Kara]

On Wed 10-06-26 09:31:22, Christian Brauner wrote:
> On Tue, Jun 09, 2026 at 12:29:05PM +0200, Jan Kara wrote:
> > On Sun 07-06-26 08:33:41, AnonymeMeow wrote:
> > > The pidfd API now supports pidfds for tasks that are not thread group leaders,
> > > but fanotify has not caught up yet. This patch set lifts that restriction and
> > > allows fanotify to report pidfds referring to the event-generating thread.
> > > 
> > > Additionally, this patch set allows fanotify to hand out pidfds for reaped
> > > tasks by registering the event pid with pidfs when pidfd reporting is
> > > requested and dropping the pid_has_task() check before the pidfd_prepare()
> > > call, as suggested by Christian.
> > > 
> > > Link: https://lore.kernel.org/lkml/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/
> > > Link: https://lore.kernel.org/lkml/20260602-patzt-sturz-segen-f1f305d61b75@brauner/
> > > 
> > > Changes since v4:
> > >  - Add a pidfs_register_pid_gfp() helper function to pass in custom flags.
> > > 
> > > v4: https://lore.kernel.org/lkml/20260603001516.26234-1-anonymemeow@gmail.com/
> > 
> > The patches look good to me. Thanks! I'd prefer the change adding gfp
> > argument to pidfs_register_pid() was a separate commit but unless Christian
> > objects I can live with that. I'll wait for Christian's ack for pidfs
> 
> I would also prefer it to be a separate commit but same as you I'm not
> gonna insist. :)
> 
> > changes before merging this through my tree.
> 
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Thanks! Merged and pushed out. AnonymeMeow, what's the situation with
fixing up fanotify20 & fanotify21 LTP tests? Are you working on it please?
They'll now start failing with linux-next so it would be good to fix that
up ASAP... Thanks!

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR