Re: [PATCH bpf-next 1/2] bpf: fix crash in bpf_path_d_path() for exiting tasks

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Oct 20, 2026 at 03:50 AM Matt Bobrowski <matt@bobrowski.net> wrote:
> Fix this by returning -EINVAL from bpf_path_d_path() when current->fs
> is NULL. Only the task itself clears its fs, in exit_fs(), so the check
> cannot race with that.

The crash is gone, but so is the path. file_release progs will get
-EINVAL for every file that a task still has open when it exits.

It also breaks what works today. The d_dname branch in d_path() returns
before it looks at current->fs, so at task exit a pipe or a socket
resolves to "pipe:[123]" now and to -EINVAL with this patch.

And it's not specific to bpf. The comment in fs/cachefiles/namei.c says
that current->fs == NULL in do_exit() breaks d_path() called from ext4
open.

can we fix it in d_path() instead ?
With an empty root prepend_path() goes up to the global root, the same
way d_absolute_path() does. Then the check in bpf_path_d_path() is not
needed and the selftest can expect the path. A chrooted task gets the
path from the global root, but it doesn't have a root anymore.

Something like this (compile tested only):

diff --git a/fs/d_path.c b/fs/d_path.c
index c253090..ea49d33 100644
--- a/fs/d_path.c
+++ b/fs/d_path.c
@@ -265,7 +265,7 @@ static void get_fs_root_rcu(struct fs_struct *fs, struct path *root)
 char *d_path(const struct path *path, char *buf, int buflen)
 {
 	DECLARE_BUFFER(b, buf, buflen);
-	struct path root;
+	struct path root = {};

 	/*
 	 * We have various synthetic filesystems that never get mounted.  On
@@ -284,7 +284,9 @@ char *d_path(const struct path *path, char *buf, int buflen)
 		return path->dentry->d_op->d_dname(path->dentry, buf, buflen);

 	rcu_read_lock();
-	get_fs_root_rcu(current->fs, &root);
+	/* Past exit_fs() there is no root to stop at, go up to the global one. */
+	if (current->fs)
+		get_fs_root_rcu(current->fs, &root);
 	if (unlikely(d_unlinked(path->dentry)))
 		prepend(&b, " (deleted)", 11);
 	else

pw-bot: cr