[PATCH 0/6] d_add() misuses in ->lookup()

[PATCH 0/6] d_add() misuses in ->lookup()

[Al Viro]

	This series converts a bunch of unidiomatic uses of d_add()
in ->lookup() instances to equivalent uses of d_splice_alias(),
which is the normal mechanism for ->lookup().

	The branch is -rc6-based and lives in
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #work.dcache-d_add
Individual patches in followups.

	All of those are equivalent transformation - we used to have bugs
with d_add() misuse in ->lookup() instances, but all cases dealt with here
were actually harmless.  If nobody objects, I'm going to throw that into
-next this weekend.  If any of these ends up picked by the trees of
relevant filesystems, all the better - just ping me and I'll drop
the commit(s) in question from the series.

Al Viro (6):
  tracefs: use d_splice_alias() in ->lookup() instances
  configfs_lookup(): switch to d_splice_alias()
  ecryptfs: use d_splice_alias() for ->lookup() return value
  simple_lookup(): use d_splice_alias() for ->lookup() return value
  ntfs: use d_splice_alias() for ->lookup() return value
  gfs2: use d_splice_alias() for ->lookup() return value

 fs/configfs/dir.c        | 3 +--
 fs/ecryptfs/inode.c      | 8 +++-----
 fs/gfs2/inode.c          | 8 ++------
 fs/libfs.c               | 3 +--
 fs/ntfs/namei.c          | 3 +--
 fs/tracefs/event_inode.c | 6 ++----
 6 files changed, 10 insertions(+), 21 deletions(-)

-- 
2.47.3

[PATCH 1/6] tracefs: use d_splice_alias() in ->lookup() instances

[Al Viro]

d_add() is not wrong there (inodes are freshly allocated), but
d_splice_alias() is more idiomatic.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/tracefs/event_inode.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 26b6453de30e..39c7a34531e8 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -389,8 +389,7 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
 	// Files have their parent's ei as their fsdata
 	dentry->d_fsdata = get_ei(parent_ei);
 
-	d_add(dentry, inode);
-	return NULL;
+	return d_splice_alias(inode, dentry);
 };
 
 /**
@@ -420,8 +419,7 @@ static struct dentry *lookup_dir_entry(struct dentry *dentry,
 
 	dentry->d_fsdata = get_ei(ei);
 
-	d_add(dentry, inode);
-	return NULL;
+	return d_splice_alias(inode, dentry);
 }
 
 static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char *name)
-- 
2.47.3

[PATCH 2/6] configfs_lookup(): switch to d_splice_alias()

[Al Viro]

more idiomatic

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/configfs/dir.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 362b6ff9b908..cd65a69765ea 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -501,8 +501,7 @@ static struct dentry * configfs_lookup(struct inode *dir,
 	}
 	spin_unlock(&configfs_dirent_lock);
 done:
-	d_add(dentry, inode);
-	return NULL;
+	return d_splice_alias(inode, dentry);
 }
 
 /*
-- 
2.47.3

[PATCH 3/6] ecryptfs: use d_splice_alias() for ->lookup() return value

[Al Viro]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/ecryptfs/inode.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 546c1fe692c0..7aaf1913f9c6 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -350,11 +350,9 @@ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
 	 */
 	lower_inode = READ_ONCE(lower_dentry->d_inode);
 
-	if (!lower_inode) {
-		/* We want to add because we couldn't find in lower */
-		d_add(dentry, NULL);
-		return NULL;
-	}
+	if (!lower_inode) /* We want to add because we couldn't find in lower */
+		return d_splice_alias(NULL, dentry);
+
 	inode = __ecryptfs_get_inode(lower_inode, dentry->d_sb);
 	if (IS_ERR(inode)) {
 		printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
-- 
2.47.3

[PATCH 4/6] simple_lookup(): use d_splice_alias() for ->lookup() return value

[Al Viro]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/libfs.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index 1bbea5e7bae3..d6205ea61afa 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -78,8 +78,7 @@ struct dentry *simple_lookup(struct inode *dir, struct dentry *dentry, unsigned
 	if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
 		return NULL;
 
-	d_add(dentry, NULL);
-	return NULL;
+	return d_splice_alias(NULL, dentry);
 }
 EXPORT_SYMBOL(simple_lookup);
 
-- 
2.47.3

[PATCH 5/6] ntfs: use d_splice_alias() for ->lookup() return value

[Al Viro]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/ntfs/namei.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index c4f82846c58c..3e21753b9f88 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -230,9 +230,8 @@ static struct dentry *ntfs_lookup(struct inode *dir_ino, struct dentry *dent,
 	if (MREF_ERR(mref) == -ENOENT) {
 		ntfs_debug("Entry was not found, adding negative dentry.");
 		/* The dcache will handle negative entries. */
-		d_add(dent, NULL);
 		ntfs_debug("Done.");
-		return NULL;
+		return d_splice_alias(NULL, dent);
 	}
 	ntfs_error(vol->sb, "ntfs_lookup_ino_by_name() failed with error code %i.",
 			-MREF_ERR(mref));
-- 
2.47.3

[PATCH 6/6] gfs2: use d_splice_alias() for ->lookup() return value

[Al Viro]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/gfs2/inode.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index e9bf4879c07f..6a3581e3ba93 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -987,12 +987,8 @@ static struct dentry *__gfs2_lookup(struct inode *dir, struct dentry *dentry,
 	int error;
 
 	inode = gfs2_lookupi(dir, &dentry->d_name, 0);
-	if (inode == NULL) {
-		d_add(dentry, NULL);
-		return NULL;
-	}
-	if (IS_ERR(inode))
-		return ERR_CAST(inode);
+	if (inode == NULL || IS_ERR(inode))
+		return d_splice_alias(inode, dentry);
 
 	gl = GFS2_I(inode)->i_gl;
 	error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &gh);
-- 
2.47.3

Re: [PATCH 5/6] ntfs: use d_splice_alias() for ->lookup() return value

[Namjae Jeon]

On Sat, Jun 6, 2026 at 3:50 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!

Re: [PATCH 6/6] gfs2: use d_splice_alias() for ->lookup() return value

[Andreas Gruenbacher]

On Sat, Jun 6, 2026 at 9:11 AM Al Viro <viro@zeniv.linux.org.uk> wrote:
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>

> ---
>  fs/gfs2/inode.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
> index e9bf4879c07f..6a3581e3ba93 100644
> --- a/fs/gfs2/inode.c
> +++ b/fs/gfs2/inode.c
> @@ -987,12 +987,8 @@ static struct dentry *__gfs2_lookup(struct inode *dir, struct dentry *dentry,
>         int error;
>
>         inode = gfs2_lookupi(dir, &dentry->d_name, 0);
> -       if (inode == NULL) {
> -               d_add(dentry, NULL);
> -               return NULL;
> -       }
> -       if (IS_ERR(inode))
> -               return ERR_CAST(inode);
> +       if (inode == NULL || IS_ERR(inode))
> +               return d_splice_alias(inode, dentry);
>
>         gl = GFS2_I(inode)->i_gl;
>         error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &gh);
> --
> 2.47.3
>

Re: [PATCH 0/6] d_add() misuses in ->lookup()

[Andreas Gruenbacher]

On Sat, Jun 6, 2026 at 9:11 AM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
>         This series converts a bunch of unidiomatic uses of d_add()
> in ->lookup() instances to equivalent uses of d_splice_alias(),
> which is the normal mechanism for ->lookup().

Thanks.

>         The branch is -rc6-based and lives in
> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git #work.dcache-d_add
> Individual patches in followups.
>
>         All of those are equivalent transformation - we used to have bugs
> with d_add() misuse in ->lookup() instances, but all cases dealt with here
> were actually harmless.  If nobody objects, I'm going to throw that into
> -next this weekend.  If any of these ends up picked by the trees of
> relevant filesystems, all the better - just ping me and I'll drop
> the commit(s) in question from the series.

I'd prefer you to push this gfs2 fix if you don't mind.

Thanks,
Andreas

> Al Viro (6):
>   tracefs: use d_splice_alias() in ->lookup() instances
>   configfs_lookup(): switch to d_splice_alias()
>   ecryptfs: use d_splice_alias() for ->lookup() return value
>   simple_lookup(): use d_splice_alias() for ->lookup() return value
>   ntfs: use d_splice_alias() for ->lookup() return value
>   gfs2: use d_splice_alias() for ->lookup() return value
>
>  fs/configfs/dir.c        | 3 +--
>  fs/ecryptfs/inode.c      | 8 +++-----
>  fs/gfs2/inode.c          | 8 ++------
>  fs/libfs.c               | 3 +--
>  fs/ntfs/namei.c          | 3 +--
>  fs/tracefs/event_inode.c | 6 ++----
>  6 files changed, 10 insertions(+), 21 deletions(-)
>
> --
> 2.47.3
>

Re: [PATCH 1/6] tracefs: use d_splice_alias() in ->lookup() instances

[Steven Rostedt]

On Sat,  6 Jun 2026 07:49:51 +0100
Al Viro <viro@zeniv.linux.org.uk> wrote:

> d_add() is not wrong there (inodes are freshly allocated), but
> d_splice_alias() is more idiomatic.
> 
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

This looks fine to me, but I haven't tested it. But anyway:

Acked-by: Steven Rostedt <rostedt@goodmis.org>

-- Steve

> ---
>  fs/tracefs/event_inode.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
> index 26b6453de30e..39c7a34531e8 100644
> --- a/fs/tracefs/event_inode.c
> +++ b/fs/tracefs/event_inode.c
> @@ -389,8 +389,7 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
>  	// Files have their parent's ei as their fsdata
>  	dentry->d_fsdata = get_ei(parent_ei);
>  
> -	d_add(dentry, inode);
> -	return NULL;
> +	return d_splice_alias(inode, dentry);
>  };
>  
>  /**
> @@ -420,8 +419,7 @@ static struct dentry *lookup_dir_entry(struct dentry *dentry,
>  
>  	dentry->d_fsdata = get_ei(ei);
>  
> -	d_add(dentry, inode);
> -	return NULL;
> +	return d_splice_alias(inode, dentry);
>  }
>  
>  static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char *name)