Re: [RFC][PATCH 11/13] allow incomplete imports of filenames

[Al Viro <viro@zeniv.linux.org.uk>]

On Tue, Nov 11, 2025 at 07:41:24AM -0700, Jens Axboe wrote:

> > diff --git a/io_uring/openclose.c b/io_uring/openclose.c
> > index bfeb91b31bba..6bc14f626923 100644
> > --- a/io_uring/openclose.c
> > +++ b/io_uring/openclose.c
> > @@ -121,6 +118,7 @@ int io_openat2(struct io_kiocb *req, unsigned int issue_flags)
> >  	struct file *file;
> >  	bool resolve_nonblock, nonblock_set;
> >  	bool fixed = !!open->file_slot;
> > +	struct filename *name __free(putname) = complete_getname(&open->filename);
> >  	int ret;
> >  
> >  	ret = build_open_flags(&open->how, &op);
> 
> I don't think this will work as-is - the prep has been done on the
> request, but we could be retrying io_openat2(). That will happen if this
> function returns -EAGAIN. That will then end up with a cleared out
> filename for the second (blocking) invocation.

If retry happens in a different thread, we do have a problem ;-/
This -EAGAIN might've come from ->open() itself (io_openat2() sets
O_NONBLOCK on the same calls), and by that point we have already
shoved that filename in direction of audit...

IMO the first 10 commits (up to and including audit_reusename() removal)
are useful on their own, but io_openat2() part does look broken.

Hmm...  FWIW, we could do a primitive like

int putname_to_incomplete(struct incomplete_name *v, struct filename *name)
{
	if (likely(name->refcnt == 1)) {
		v->__incomplete_filename = name;
		return 0;
	}
	v->__incomplete_filename = <duplicate name>;
	putname(name);
	if (unlikely(!v->__incomplete_filename))
		return -ENOMEM;
	return 0;
}

and have
                if (ret == -EAGAIN &&
		    (!resolve_nonblock && (issue_flags & IO_URING_F_NONBLOCK))) {
			ret = putname_to_incomplete(&open->filename,
						    no_free_ptr(name));
			if (unlikely(ret))
				goto err;
			return -EAGAIN;
		}

in io_openat2() (in addition to what's already done in 11/13).  Workable or
too disgusting?