Re: [PATCH v7 1/4] fs: configfs: add helpers for opening non-configfs paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] fs: deadlock bypass in configfs_open_root() via mountpoint traversal
--

commit 493a740e66f883a25d1e14e7e3f3596fe9f2721a
Author: Runyu Xiao <runyu.xiao@seu.edu.cn>

fs: configfs: add helpers for opening non-configfs paths

This commit adds configfs_file_open() and configfs_open_root() to allow
configfs store callbacks to open non-configfs paths without re-entering
configfs. It checks if the provided root is on configfs to prevent
acquiring the non-recursive fragment semaphore again.

Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

> diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
> --- a/fs/configfs/mount.c
> +++ b/fs/configfs/mount.c

[ ... ]

> +struct file *configfs_open_root(const struct path *root, const char *name,
> +				int flags, umode_t mode)
> +{
> +	if (root->dentry->d_sb->s_type == &configfs_fs_type)
> +		return ERR_PTR(-EINVAL);
> +
> +	return file_open_root(root, name, flags, mode);

[Severity: Medium]
Could this bypass the deadlock prevention if a configfs mount exists inside the
starting directory?

The check against configfs_fs_type only validates the starting root directory's
superblock. However, file_open_root() can traverse mountpoints.

If a user mounts configfs inside the non-configfs root directory, the final
resolved file could still be on configfs.

If this happens during a store callback that already holds frag_sem,
file_open_root() opening the file will trigger configfs_open_file(). This
would try to acquire down_read(&frag->frag_sem) again, which could result
in a deadlock.

> +}
> +EXPORT_SYMBOL_GPL(configfs_open_root);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927082011.638723-1-runyu.xiao@seu.edu.cn?part=1