Re: [PATCH bpf-next v1 08/11] namei: add an rcu-walk mode to the ancestor walk

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] vfs: TOCTOU race in vfs_walk_handover() sequence validation
--

commit 1f35bee40e8028ac4b024dd5a54b6bbdbb5b8521
Author: Justin Suess <utilityemal77@gmail.com>

namei: add an rcu-walk mode to the ancestor walk

This commit introduces an rcu-walk mode for the stepwise ancestor walk.
It adds lockless progression using sequence validation and provides
vfs_walk_handover() to transition an unreferenced RCU walk into a
referenced walk.

> diff --git a/fs/namei.c b/fs/namei.c
> --- a/fs/namei.c
> +++ b/fs/namei.c

[ ... ]

> +bool vfs_walk_handover(struct vfs_ancestor_walk *to,
> +		       struct vfs_ancestor_walk *from)
> +{
> +	struct path pos = from->pos;
> +	int err;
> +
> +	err = __legitimize_mnt(pos.mnt, from->m_seq);
> +	if (unlikely(err)) {
> +		if (err < 0)
> +			mnt_undo_legitimize(real_mount(pos.mnt));
> +		goto dead;
> +	}
> +	if (unlikely(read_seqcount_retry(&pos.dentry->d_seq, from->seq) ||
> +		     !lockref_get_not_dead(&pos.dentry->d_lockref))) {

[Severity: High]
Is there a time-of-check to time-of-use race window here due to the
validation order?

Evaluating read_seqcount_retry() before lockref_get_not_dead() seems to leave
a gap. If a concurrent rename or unlink mutates the dentry and increments the
seqcount right after the sequence check, the subsequent lockref_get_not_dead()
might still blindly succeed on the active d_count.

This would yield a stale and unvalidated path position to the referenced
walk. Should the lockref acquisition strictly precede sequence validation to
ensure the sequence hasn't changed during the reference acquisition?

> +		mnt_undo_legitimize(real_mount(pos.mnt));
> +		goto dead;
> +	}
> +	to->pos = pos;
> +	to->flags = 0;
> +	to->pos_flags = from->pos_flags;
> +	return true;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013164800.2906577-1-utilityemal77@gmail.com?part=8