Re: [PATCH bpf-next v1 08/11] namei: add an rcu-walk mode to the ancestor walk

[Justin Suess <utilityemal77@gmail.com>]

On Tue, Oct 13, 2026 at 05:01:26PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] vfs: TOCTOU race in vfs_walk_handover() sequence validation
> --
> 
> commit 1f35bee40e8028ac4b024dd5a54b6bbdbb5b8521
> Author: Justin Suess <utilityemal77@gmail.com>
> 
> namei: add an rcu-walk mode to the ancestor walk
> 
> This commit introduces an rcu-walk mode for the stepwise ancestor walk.
> It adds lockless progression using sequence validation and provides
> vfs_walk_handover() to transition an unreferenced RCU walk into a
> referenced walk.
> 
> > diff --git a/fs/namei.c b/fs/namei.c
> > --- a/fs/namei.c
> > +++ b/fs/namei.c
> 
> [ ... ]
> 
> > +bool vfs_walk_handover(struct vfs_ancestor_walk *to,
> > +		       struct vfs_ancestor_walk *from)
> > +{
> > +	struct path pos = from->pos;
> > +	int err;
> > +
> > +	err = __legitimize_mnt(pos.mnt, from->m_seq);
> > +	if (unlikely(err)) {
> > +		if (err < 0)
> > +			mnt_undo_legitimize(real_mount(pos.mnt));
> > +		goto dead;
> > +	}
> > +	if (unlikely(read_seqcount_retry(&pos.dentry->d_seq, from->seq) ||
> > +		     !lockref_get_not_dead(&pos.dentry->d_lockref))) {
> 
> [Severity: High]
> Is there a time-of-check to time-of-use race window here due to the
> validation order?
> 
> Evaluating read_seqcount_retry() before lockref_get_not_dead() seems to leave
> a gap. If a concurrent rename or unlink mutates the dentry and increments the
> seqcount right after the sequence check, the subsequent lockref_get_not_dead()
> might still blindly succeed on the active d_count.
> 
> This would yield a stale and unvalidated path position to the referenced
> walk. Should the lockref acquisition strictly precede sequence validation to
> ensure the sequence hasn't changed during the reference acquisition?
>
This is intended and explained in the cover letter note,
"stuff not changed" bullet one.

Justin
> > +		mnt_undo_legitimize(real_mount(pos.mnt));
> > +		goto dead;
> > +	}
> > +	to->pos = pos;
> > +	to->flags = 0;
> > +	to->pos_flags = from->pos_flags;
> > +	return true;
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261013164800.2906577-1-utilityemal77@gmail.com?part=8