[PATCH v4 0/3] nvmet: avoid recursive configfs open

[PATCH v4 0/3] nvmet: avoid recursive configfs open

[Runyu Xiao]

The nvmet configfs store callbacks hold the item's frag_sem while they
enable file-backed namespaces or passthru controllers. Both paths open a
user-configured pathname. If it resolves into configfs, the open path can
re-enter __configfs_open_file() and try to acquire the same frag_sem again.

Add configfs helpers that resolve configured paths, reject configfs-backed
paths, and open the resolved path with file_open_root(). This keeps the
normal open-time permission and security checks while preventing the
recursive configfs open.

Changes since v3:
- Move path lookup, configfs rejection, and file_open_root() into the
  configfs helper, as requested by Christoph Hellwig.
- Use the helper from both nvmet backend open paths.
- Provide a root-relative helper for callers that retain a resolved root,
  including callers that create files below a pinned root.
- Drop the previous Reviewed-by tags because the helper interface changed.

Runyu Xiao (3):
  fs: configfs: add helpers for opening non-configfs paths
  nvmet: avoid recursive configfs open for file-backed namespaces
  nvmet: avoid recursive configfs open for passthru

 drivers/nvme/target/io-cmd-file.c |  3 ++-
 drivers/nvme/target/passthru.c    |  3 ++-
 fs/configfs/mount.c               | 33 +++++++++++++++++++++++++++++++
 include/linux/configfs.h          |  6 ++++++
 4 files changed, 43 insertions(+), 2 deletions(-)


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.34.1

[PATCH v4 1/3] fs: configfs: add helpers for opening non-configfs paths

[Runyu Xiao]

Configfs store callbacks may open user-configured paths while holding an
item frag_sem. Opening a configfs path from such a callback can re-enter
configfs and try to acquire the same semaphore.

Add helpers that reject configfs paths by comparing the actual filesystem
type and open the resolved path with file_open_root(), preserving normal
open-time permission and security checks. Provide a root-relative form for
callers that retain a resolved root and may create a file below it.

Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 fs/configfs/mount.c      | 33 +++++++++++++++++++++++++++++++++
 include/linux/configfs.h |  6 ++++++
 2 files changed, 39 insertions(+)

diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index d8cac1cbf3bd5..77e1788ce2372 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/fs_context.h>
+#include <linux/namei.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -118,6 +119,38 @@ static struct file_system_type configfs_fs_type = {
 };
 MODULE_ALIAS_FS("configfs");
 
+bool configfs_path_is_configfs(const struct path *path)
+{
+	return path->dentry->d_sb->s_type == &configfs_fs_type;
+}
+EXPORT_SYMBOL_GPL(configfs_path_is_configfs);
+
+struct file *configfs_open_root(const struct path *root, const char *name,
+				int flags, umode_t mode)
+{
+	if (configfs_path_is_configfs(root))
+		return ERR_PTR(-EINVAL);
+
+	return file_open_root(root, name, flags, mode);
+}
+EXPORT_SYMBOL_GPL(configfs_open_root);
+
+struct file *configfs_file_open(const char *filename, int flags, umode_t mode)
+{
+	struct file *file;
+	struct path path;
+	int ret;
+
+	ret = kern_path(filename, LOOKUP_FOLLOW, &path);
+	if (ret)
+		return ERR_PTR(ret);
+
+	file = configfs_open_root(&path, "", flags, mode);
+	path_put(&path);
+	return file;
+}
+EXPORT_SYMBOL_GPL(configfs_file_open);
+
 struct dentry *configfs_pin_fs(void)
 {
 	int err = simple_pin_fs(&configfs_fs_type, &configfs_mount,
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index ef65c75beeaad..768132b2be1ae 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -34,6 +34,8 @@ struct configfs_group_operations;
 struct configfs_attribute;
 struct configfs_bin_attribute;
 struct configfs_subsystem;
+struct file;
+struct path;
 
 struct config_item {
 	char			*ci_name;
@@ -243,6 +245,10 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys);
 int configfs_register_group(struct config_group *parent_group,
 			    struct config_group *group);
 void configfs_unregister_group(struct config_group *group);
+bool configfs_path_is_configfs(const struct path *path);
+struct file *configfs_open_root(const struct path *root, const char *name,
+				int flags, umode_t mode);
+struct file *configfs_file_open(const char *filename, int flags, umode_t mode);
 
 void configfs_remove_default_groups(struct config_group *group);
 
-- 
2.34.1

Re: [PATCH v4 1/3] fs: configfs: add helpers for opening non-configfs paths

[Christoph Hellwig]

On Mon, Sep 21, 2026 at 05:05:57PM +0800, Runyu Xiao wrote:
> +bool configfs_path_is_configfs(const struct path *path)
> +{
> +	return path->dentry->d_sb->s_type == &configfs_fs_type;
> +}
> +EXPORT_SYMBOL_GPL(configfs_path_is_configfs);
> +
> +struct file *configfs_open_root(const struct path *root, const char *name,
> +				int flags, umode_t mode)
> +{
> +	if (configfs_path_is_configfs(root))
> +		return ERR_PTR(-EINVAL);
> +
> +	return file_open_root(root, name, flags, mode);
> +}
> +EXPORT_SYMBOL_GPL(configfs_open_root);

These two aren't used outside this file, so they could be static,
or in case of configfs_path_is_configfs even be folded into the
only caller.  Or do you plan to have other users?

> +struct file *configfs_file_open(const char *filename, int flags, umode_t mode)

Can you add a kerneldoc comment explaining how/why this should be used?

Re: [PATCH v4 1/3] fs: configfs: add helpers for opening non-configfs paths

[Runyu Xiao]

Thanks for the reviews.

> > +bool configfs_path_is_configfs(const struct path *path)
> > +{
> > +	return path->dentry->d_sb->s_type == &configfs_fs_type;
> > +}
> > +EXPORT_SYMBOL_GPL(configfs_path_is_configfs);
> > +
> > +struct file *configfs_open_root(const struct path *root, const char *name,
> > +			int flags, umode_t mode)
> > +{
> > +	if (configfs_path_is_configfs(root))
> > +		return ERR_PTR(-EINVAL);
> > +
> > +	return file_open_root(root, name, flags, mode);
> > +}
> > +EXPORT_SYMBOL_GPL(configfs_open_root);
>
> These two aren't used outside this file, so they could be static,
> or in case of configfs_path_is_configfs even be folded into the
> only caller.  Or do you plan to have other users?

I folded the filesystem-type check into configfs_open_root() and dropped
the predicate entirely.  configfs_file_open() is for callers that have a
pathname, while configfs_open_root() is for callers that keep a resolved
root and open files below it.

> > +struct file *configfs_file_open(const char *filename, int flags, umode_t mode)
>
> Can you add a kerneldoc comment explaining how/why this should be used?

I will add kerneldoc comments for both helpers in v5.

> Didn't you also have patches for drivers/target/ that should use
> the new helper?

Yes.  The target-core patch titled "scsi: target: pin db_root for metadata
writes" is another consumer of configfs_open_root().  I will rebase that
patch on this series and drop its duplicate configfs changes.

The separate patch titled "scsi: target: file: avoid recursive configfs open
in fd_init_prot()" will use configfs_file_open(), not configfs_open_root().

I will send v5 as a new thread.  Patches 2/3 and 3/3 are unchanged and
retain your Reviewed-by.

Thanks,
Runyu

Re: [PATCH v4 1/3] fs: configfs: add helpers for opening non-configfs paths

[Christoph Hellwig]

On Wed, Sep 23, 2026 at 10:39:23AM +0800, Runyu Xiao wrote:
> > > +EXPORT_SYMBOL_GPL(configfs_open_root);
> >
> > These two aren't used outside this file, so they could be static,
> > or in case of configfs_path_is_configfs even be folded into the
> > only caller.  Or do you plan to have other users?
> 
> I folded the filesystem-type check into configfs_open_root() and dropped
> the predicate entirely.  configfs_file_open() is for callers that have a
> pathname, while configfs_open_root() is for callers that keep a resolved
> root and open files below it.

Which callers are those?  There are none in this series, so right now
this is just adding dead code.  If you have other callers, please send
everything in one series, as it needs to go together.

> 
> > > +struct file *configfs_file_open(const char *filename, int flags, umode_t mode)
> >
> > Can you add a kerneldoc comment explaining how/why this should be used?
> 
> I will add kerneldoc comments for both helpers in v5.

The versions added look like extremely verbose AI generated text.
Please use your own brains and your own voice to write a concise
description.

> 
> > Didn't you also have patches for drivers/target/ that should use
> > the new helper?
> 
> Yes.  The target-core patch titled "scsi: target: pin db_root for metadata
> writes" is another consumer of configfs_open_root().  I will rebase that
> patch on this series and drop its duplicate configfs changes.

Please merge everything into one series.

[PATCH v4 2/3] nvmet: avoid recursive configfs open for file-backed namespaces

[Runyu Xiao]

nvmet_ns_enable_store() runs as a configfs store callback while configfs
holds the item frag_sem. File-backed namespace enable used filp_open() on
the configured device_path, so a path into configfs could re-enter
__configfs_open_file() and try to acquire the same semaphore again.

Use configfs_file_open() so the path is resolved before opening,
configfs-backed paths are rejected, and the resolved path is opened with
file_open_root() while retaining the normal open-time permission and
security checks.

Fixes: d5eff33ee6f8 ("nvmet: add simple file backed ns support")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/nvme/target/io-cmd-file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 0b22d183f9279..2a4f25de94ba1 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -8,6 +8,7 @@
 #include <linux/uio.h>
 #include <linux/falloc.h>
 #include <linux/file.h>
+#include <linux/configfs.h>
 #include <linux/fs.h>
 #include "nvmet.h"
 
@@ -38,7 +39,7 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns)
 	if (!ns->buffered_io)
 		flags |= O_DIRECT;
 
-	ns->file = filp_open(ns->device_path, flags, 0);
+	ns->file = configfs_file_open(ns->device_path, flags, 0);
 	if (IS_ERR(ns->file)) {
 		ret = PTR_ERR(ns->file);
 		pr_err("failed to open file %s: (%d)\n",
-- 
2.34.1

Re: [PATCH v4 2/3] nvmet: avoid recursive configfs open for file-backed namespaces

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

[PATCH v4 3/3] nvmet: avoid recursive configfs open for passthru

[Runyu Xiao]

nvmet_passthru_enable_store() runs as a configfs store callback while
configfs holds the item frag_sem. Passthru enable used filp_open() on the
configured controller path, so a path into configfs could re-enter
__configfs_open_file() and try to acquire the same semaphore again.

Use configfs_file_open() so the path is resolved before opening,
configfs-backed paths are rejected, and the resolved path is opened with
file_open_root() while retaining the normal open-time permission and
security checks.

Fixes: cae5b01a2afc ("nvmet: introduce the passthru configfs interface")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/nvme/target/passthru.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c
index fa6527c537e26..d60256004e6cf 100644
--- a/drivers/nvme/target/passthru.c
+++ b/drivers/nvme/target/passthru.c
@@ -9,6 +9,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
+#include <linux/configfs.h>
 
 #include "../host/nvme.h"
 #include "nvmet.h"
@@ -602,7 +603,7 @@ int nvmet_passthru_ctrl_enable(struct nvmet_subsys *subsys)
 		goto out_unlock;
 	}
 
-	file = filp_open(subsys->passthru_ctrl_path, O_RDWR, 0);
+	file = configfs_file_open(subsys->passthru_ctrl_path, O_RDWR, 0);
 	if (IS_ERR(file)) {
 		ret = PTR_ERR(file);
 		goto out_unlock;
-- 
2.34.1

Re: [PATCH v4 3/3] nvmet: avoid recursive configfs open for passthru

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Didn't you also have patches for drivers/target/ that should use
the new helper?