[PATCH] devtmpfs: restore mount option reconfiguration on get_tree

[PATCH] devtmpfs: restore mount option reconfiguration on get_tree

[Simon Liebold]

Commit cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in
public instance") converted devtmpfs to the new mount API but dropped
the reconfigure_single() call that reapplied mount options.

This causes userspace-requested mount options to be silently ignored.

To reproduce, boot a system where systemd mounts /dev with a size
option (e.g. size=4m), then check the actual size:

    findmnt -n -o SIZE --bytes /dev

On an affected kernel this returns ~50% of RAM instead of the
requested size.

Fix by calling fc->ops->reconfigure() after obtaining the superblock
reference in devtmpfs_get_tree().

Fixes: cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in public instance")
Cc: stable@vger.kernel.org
Signed-off-by: Simon Liebold <simonlie@amazon.de>
---
 drivers/base/devtmpfs.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index b1c4ceb65026e..44683dde04377 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -72,14 +72,25 @@ static struct file_system_type internal_fs_type = {
 	.kill_sb = kill_anon_super,
 };
 
-/* Simply take a ref on the existing mount */
+/* Take a ref on the existing mount and reconfigure to apply mount options. */
 static int devtmpfs_get_tree(struct fs_context *fc)
 {
 	struct super_block *sb = mnt->mnt_sb;
+	int err;
 
 	atomic_inc(&sb->s_active);
 	down_write(&sb->s_umount);
 	fc->root = dget(sb->s_root);
+
+	if (fc->ops->reconfigure) {
+		err = fc->ops->reconfigure(fc);
+		if (err) {
+			dput(fc->root);
+			fc->root = NULL;
+			deactivate_locked_super(sb);
+			return err;
+		}
+	}
 	return 0;
 }
 

base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
2.50.1

Re: [PATCH] devtmpfs: restore mount option reconfiguration on get_tree

[Eric Sandeen]

On 8/10/26 3:34 AM, Simon Liebold wrote:
> Commit cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in
> public instance") converted devtmpfs to the new mount API but dropped
> the reconfigure_single() call that reapplied mount options.
> 
> This causes userspace-requested mount options to be silently ignored.

hohum, I'm not sure how I managed to re-break that - I had cc'd neilb
precisely because I knew he had fixed a regression here before, so
it must have been on my mind.

Looking back to an IRC conversation with viro I think I diverged from
his recommendation though I'm not sure why.

I had credited viro in my changelog, but looking back I don't think I
faithfully implemented what he had suggested. I'd like to revisit that
and maybe propose a different solution to fixing this.

(One concern is approach is that I think it is now passing an fc which
was not "for_reconfigure" to reconfigure, for starters, but that's on
me I think for setting it up this way ...)

Give me a day or so to try to page all this back in again? And sorry
for breaking it. :(

Thanks,
-Eric

> To reproduce, boot a system where systemd mounts /dev with a size
> option (e.g. size=4m), then check the actual size:
> 
>     findmnt -n -o SIZE --bytes /dev
> 
> On an affected kernel this returns ~50% of RAM instead of the
> requested size.
> 
> Fix by calling fc->ops->reconfigure() after obtaining the superblock
> reference in devtmpfs_get_tree().
> 
> Fixes: cb0e0a8bf4e1 ("devtmpfs: replace ->mount with ->get_tree in public instance")
> Cc: stable@vger.kernel.org
> Signed-off-by: Simon Liebold <simonlie@amazon.de>
> ---
>  drivers/base/devtmpfs.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
> index b1c4ceb65026e..44683dde04377 100644
> --- a/drivers/base/devtmpfs.c
> +++ b/drivers/base/devtmpfs.c
> @@ -72,14 +72,25 @@ static struct file_system_type internal_fs_type = {
>  	.kill_sb = kill_anon_super,
>  };
>  
> -/* Simply take a ref on the existing mount */
> +/* Take a ref on the existing mount and reconfigure to apply mount options. */
>  static int devtmpfs_get_tree(struct fs_context *fc)
>  {
>  	struct super_block *sb = mnt->mnt_sb;
> +	int err;
>  
>  	atomic_inc(&sb->s_active);
>  	down_write(&sb->s_umount);
>  	fc->root = dget(sb->s_root);
> +
> +	if (fc->ops->reconfigure) {
> +		err = fc->ops->reconfigure(fc);
> +		if (err) {
> +			dput(fc->root);
> +			fc->root = NULL;
> +			deactivate_locked_super(sb);
> +			return err;
> +		}
> +	}
>  	return 0;
>  }
>  
> 
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff