From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f41.google.com (mail-yx1-f41.google.com [74.125.224.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91E5351DDED for ; Tue, 13 Oct 2026 16:48:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791910097; cv=none; b=KbJGdTyaZixWiTQsSKWSDBTKGBbqGxmFBHqoWJMbpi+88M2TA3UdMvGuS/1CnuWeKBay7gQIjlxto/aoSVMSuZr6s+b0QGwMmzoZf352/2YXZIIHbMasMxAg9UHnwJTbf8ZpbOXxc2BtnhwoGocHNIV8vc+3M9MgCs/pUp/z7IQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791910097; c=relaxed/simple; bh=fxGS0KDBWStjrqyKtmCx3JA0nIxD5douxgGJQijWt4M=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NXo9kZ44xTmU1sFq22ELPjowbOuZEzw1PVRv1+KHFEG/MvFhodmvheXzWh5f0XhxncAjjXEPQMNBwqe4F6iNuygg0ph5iWidnZSx/dJdCA6izNgzSdQUZVKntXhquaKGbZZ1+OqUUQTjr9TYgnDwiq1oj1dnQnH+Mj7OD6foYHw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=At4VtRdY; arc=none smtp.client-ip=74.125.224.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="At4VtRdY" Received: by mail-yx1-f41.google.com with SMTP id 956f58d0204a3-6756a01fa01so3072403d50.0 for ; Tue, 13 Oct 2026 09:48:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791910094; x=1792514894; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=F/tCO70XLvBQZ+VECtj2XSlthzSz2vi6dAShJcsMRWs=; b=At4VtRdY3S/4VyjeBEk4k0oigcfYvJeXrsJmEbFJ8sbbQqJ1LEH+P8+kroUbWFdH+1 s4fYPclCWVhFG/pVo0PzOEJXWU5VY8cMHA/H3k/6LD4roIV+YX0rM4+0qrk8zafCGNdy M5bPNpsB+TLUY8j3X94X4HcT/Eny1Ml6y7rQ7BXCDSq/IT9Vt6Fw/T1QrOqzCwAcfJBh 4IK+3rM8veizHNGr6Nh9hrhOV9W6Aai8Ki/3FxcePdau//2Rg50qsSKmVAADpCsXUX7s +iXo423ah42PUn6PdrknaN8fowULFc7KVuS7u8s1la4hhtIpSyXtcGLjVF6ZHzpz/lcp qsvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791910094; x=1792514894; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=F/tCO70XLvBQZ+VECtj2XSlthzSz2vi6dAShJcsMRWs=; b=YU/uaiuhfOf9FirJwOrRu3D3MdybRXTJ3rykD+NzDUQhSV0NaEQycCXrx3A0jj9V5s OkDUQfNOGPrWwLDpg09cBLANk5Cggdo+u+xCA5+EURgkBaDvqajGHxH/kJbX2oZDN8Zt GzYjQ9KwWsjqwCCrqHcGdetb3y5xWZdA/yFKmolKaHtzUBkHAz0mrmrtTTGxj/tUZ8xw vvIO3xnrSlqjjLagPUhIAKAh1FoovKc672QItiafVUGqQ1sJjbLPL1XWWOQBCIEqdlBT RtXDyhkZyzMudDy4xUi1qU5M52AiX/yN3CuDTx9a2mRbR/xEublBg1KoPLp+gLbJ1mZu lv7w== X-Forwarded-Encrypted: i=1; AKwUvBwDH+dldJ22e97/Gk2lrMXxxz0MjusxW5brJVHxAHlwnalfb43RaASa/Fh/mEAbcSrqOMlkU9wN8QD7NCE=@vger.kernel.org X-Gm-Message-State: AFq9FYK8twHzm8ZPnAG7aRmZU6ucCGfTuL99z1kaYv1tVV+FNdlwbntq ziyo4nvTQEioyedjNHKXPE3jWbGaX/l+fiMufYMoq5FX7EhSfrNSwH/k X-Gm-Gg: AYBFou18WjqnQtiOP0fMc03OSor0Ovqq474vp67OGkXZtr0UMctDS1ifj4FzJNBDuG4 9bpEFC+DV0Wc1TWZweDNvIxUnz4vCdiisFrkHORWlqqsOw6OCGilV4Fy9b594gvMBWavc74Cc6l +FC922mCVWZs75jmfYcwb8ArY9GFRf4/okJ0oAz4Zc7oP1arW+SE/zld9hgTf+LiIxj9JJyKka8 uCX0dZI6rpAVHXKeHE69qNBS1hYmBjfyP7PDm4eE9iEh4TV7FkMrxAwRDcAMoZ7mPy/QHpy/34t UrCPyx9Y5TU45uHWdMjuMwTUK2YtHpEpw3ypHWYorj29JnPm650aOwIARGZrWWbGSlR3Tnaqs0O 9qWzZw2fnoqAbGnP7rMeVVg0JcZEd4MZajXTSrvMsIkWZbWvC1eCiU8QFBuWxc4Oehya6fHUW+U JbmYkE8cvB0BQFFvSph42tQkr4QaqfmP7B1B1ZIvlkSy7gD+TaDpwRMOjkYoi1UGMRvOzLIxIx X-Received: by 2002:a05:690e:1383:b0:671:7e90:70f4 with SMTP id 956f58d0204a3-6793678d44dmr4486938d50.10.1791910094243; Tue, 13 Oct 2026 09:48:14 -0700 (PDT) Received: from zenbox ([2600:1700:18fb:6011:d326:f863:5ae3:683]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-67986a89294sm81136d50.15.2026.10.13.09.48.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 09:48:13 -0700 (PDT) From: Justin Suess To: Christian Brauner , Alexander Viro , Jan Kara , NeilBrown , =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Song Liu Cc: linux-fsdevel@vger.kernel.org, bpf@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, =?UTF-8?q?G=C3=BCnther=20Noack?= , Paul Moore , James Morris , "Serge E . Hallyn" , Martin KaFai Lau , Eduard Zingerman , Yonghong Song , John Fastabend , Kumar Kartikeya Dwivedi , Jiri Olsa , Jeff Layton , Amir Goldstein , Mateusz Guzik , Shuah Khan , Tingmao Wang , Justin Suess Subject: [PATCH bpf-next v1 00/11] fs: unified VFS ancestor walk for Landlock and BPF Date: Tue, 13 Oct 2026 12:47:49 -0400 Message-ID: <20261013164800.2906577-1-utilityemal77@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Howdy folks, This series adds a VFS API for walking a path's ancestors that covers both path-walk modes (refwalk and rcu-walk, plus the hybrid walk) through a unified interface, converts Landlock to it, and exposes it to BPF LSM programs. It picks up Song Liu's bpf path iterator series [1] where the discussion left it, and tries to be the synthesis of what came out of that thread: a combination of the callback and open-coded approaches proposed there. The structure is unchanged from the RFC [2]: a stepwise engine private to namei.c, a callback front-end for in-kernel callers (Landlock is converted, fixing the follow_up() race Al reported, hence the Fixes: tag on patch 3), and open-coded BPF iterators over the engine in referenced and rcu flavors, with bpf_path_ancestors_legitimize() escalating from the latter to the former mid-walk. Patch 1 is carried from Song's series. See the RFC cover for the full background and API listing. This is v1 following the RFC and bot feedback, and some of the sillier mistakes are rectified. Biggest change is that Song's patch 4 adding BTF_TYPE_SAFE_TRUSTED is dropped, following [3]. This code wasn't an issue in his original patchset, because that implementation was refwalk only, whereas this one handles rcu-walk. The problem is that trusted types acquired under RCU don't propagate their RCU-ness to their fields. Thus marking the path trusted allows you to use the dentry from an RCU-acquired struct path outside RCU. Verifier fixes propagating the RCU-ness to trusted fields can be done, but it's best as a separate series where the idea can be examined more closely. Then marking the dentry as trusted will allow you to use the dentry xattr kfuncs. Nothing in this series strictly depends on having a trusted dentry, nor will marking it trusted require changes in this API. See my follow up [4]. Other changes since the RFC: - vfs_walk_ancestors() is introduced already built on the stepwise engine, and the RFC's restructuring patch became a pure exposure patch (patch 4): the engine is no longer rewritten mid-series. - vfs_walk_handover() carries the position's flags over, so an escalated walk no longer drops VFS_WALK_POS_MOUNTPOINT. - A failed bpf_path_ancestors_legitimize() marks the destination iterator with BPF_PATH_ANCESTORS_RETRY instead of leaving it indistinguishable from a walk that completed at the root; a drained source returns -ENOENT, a lost race returns -ECHILD. - vfs_walk_start() warns on and masks unknown flag bits, which the engine shares the flags word with. - mnt_undo_legitimize() asserts it is called inside an RCU read-side critical section. - Selftests verify the walk actually reaches / (position count plus end-of-walk flags), use an acquired position only after the iterator is destroyed so the program's reference is provably what keeps it alive and retrigger when a concurrent mount anywhere in the system legitimately ends the lockless walks with RETRY. - Stale comments and kernel-doc contracts fixed; notably, rcu-mode callback reads race with concurrent changes exactly as in a referenced walk, now stated at vfs_walk_ancestors(). Stuff deliberately not changed: - vfs_walk_handover() validates the seqcount before taking the dentry reference, the reverse of __legitimize_path() [5]. That ordering is what lets a failed handover leave nothing to put inside the caller's RCU read-side critical section, and the window it opens is indistinguishable from a rename landing right after a successful handover, which any referenced walk tolerates anyway. This matches behavior with in-tree existing rcu-walk implementations. - A callback that stops an rcu-mode walk gets no final seq revalidation [5]. This matches rcu-walk practice: may_lookup() returns hard verdicts from RCU data without one, and d_walk()'s D_WALK_QUIT skips its seqretry. Keeping a position is what validates, via the handover. - An "__uninit" iterator argument is marked initialized as it is processed, so a later "__iter" argument of the same kfunc aliasing the same stack slots would see it as initialized [6]. Reaching that needs a kfunc whose "__uninit" destination and "__iter" source share one iterator BTF type. The slots record the destination's type, so a mismatch fails the "__iter" check regardless of aliasing, which is what makes this immune. Answered in [7]. Landlock kselftests pass in full (914/914 under UML) on this revision. [1] https://lore.kernel.org/bpf/20250617061116.3681325-1-song@kernel.org/ [2] https://lore.kernel.org/bpf/20261006002020.2890858-1-utilityemal77@gmail.com/ [3] https://lore.kernel.org/bpf/efdfa80872c26e9e1b6fe11957ecba8e1b5ffcdad421e34281ed3ebd017b5752@mail.kernel.org/ [4] https://lore.kernel.org/bpf/asUBWNVtSzLXkXsF@zenbox/ [5] https://lore.kernel.org/bpf/20261006003305.44F761F000FF@smtp.kernel.org/ [6] https://lore.kernel.org/bpf/20261006003716.CC7791F000FF@smtp.kernel.org/ [7] https://lore.kernel.org/bpf/asUK2i4229DNzXLI@zenbox/ Justin Suess (10): namei: add vfs_walk_ancestors() landlock: convert ancestor walk to vfs_walk_ancestors() namei: expose the stepwise ancestor walk to fs/ bpf: add a path ancestor iterator selftests/bpf: exercise the path ancestor iterator fs: add mnt_undo_legitimize() namei: add an rcu-walk mode to the ancestor walk bpf: support "__uninit" iterator arguments in generic kfuncs bpf: add a lockless path ancestor iterator selftests/bpf: exercise the lockless path ancestor iterator Song Liu (1): namei: introduce __path_walk_parent() fs/bpf_fs_kfuncs.c | 248 ++++++++++++ fs/internal.h | 22 + fs/mount.h | 1 + fs/namei.c | 380 ++++++++++++++++-- fs/namespace.c | 65 ++- include/linux/namei.h | 17 + kernel/bpf/verifier.c | 44 +- security/landlock/fs.c | 266 ++++++------ .../selftests/bpf/prog_tests/path_ancestors.c | 86 ++++ .../selftests/bpf/progs/path_ancestors.c | 146 +++++++ 10 files changed, 1098 insertions(+), 177 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/path_ancestors.c create mode 100644 tools/testing/selftests/bpf/progs/path_ancestors.c base-commit: 763187dbbf83764a57d5811168ef9de7b9a60e2d -- 2.55.0